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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH THE TWITTER 
_— eg = 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


Case No.  17-MJ-567 


Nee Ne ee ee ee 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California 


(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before August 21, 2017 (not to exceed 14 days) 
@ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell 
: (United States Magistrate Judge) 


Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 


QO for days (not to exceed 30) C until, the facts justifying, the later specific date of ` 
: : . j 2 N srn LEY 5 Z 
Date and time issued: agot F AP 172 A LA Yt 
: udge 's signature - : 
City and state: Washington, D.C. Hon. Beryl A. Howell~Chief U.S. District Judge 


' _ “Printed name and title 
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ATTACHMENT A 
Property to Be Searched 


This warrant applies to information associated with the Twitter profile with usernames: 


that is stored at premises owned, maintained, controlled, or operated by Twitter, a company 


headquartered in San Francisco, California. 
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ATTACHMENT B 
Particular Things to be Seized 

I. Information to be disclosed by Twitter 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of Twitter, including any messages, records, files, logs, or information that 
have been deleted but are still available to Twitter, or have been preserved pursuant to a request 
made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following information to the 
government for each account listed in Attachment A: 

a. All identity and contact information, including full name, e-mail address, physical 

address (including city, state, and zip code), date of birth, gender, hometown, 


occupation, and other personal identifiers; 


b. All past and current usernames, account passwords, and names associated with 
the account; 
c. The dates and times at which the account and profile were created, and the 


Internet Protocol (“IP”) address at the time of sign-up; 

d. All IP logs and other documents showing the IP address, date, and time of each 
login to the account; 

e. All data and information associated with the profile page, including photographs, 
“bios,” and profile backgrounds and themes; 

f. All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the 
account, and all photographs or images included in those Tweets and Direct 


Messages; 
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g. All information from the “Connect” tab for the account, including all lists of 
Twitter users who have favorited or retweeted Tweets posted by the account, as 
well as a list of all Tweets that include the username associated with the account 
(i.e., “mentions” or “replies”); 

h. All photographs and images in the user gallery for the account; 

i. All location data associated with the account, including all information collected 
by the “Tweet With Location” service; 

j. All information about the account’s use of Twitter’s link service, including all 
longer website links that were shortened by the service, all resulting shortened 
links, and all information about the number of times that a link posted by the 
account was clicked; 

k. All data and information that has been deleted by the user; 

l. A list of all of the people that the user follows on Twitter and all people who are 


following the user (Z.e., the user’s “following” list and “followers” list); 


m. A list of all users that the account has “unfollowed” or blocked; 

n. All “lists” created by the account; 

o. All information on the “Who to Follow” list for the account; 

p. All privacy and account settings; 

q. All records of Twitter searches performed by the account, including all past 


searches saved by the account; 
r. All information about connections between the account and third-party websites 


and applications; 
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s. All records pertaining to communications between Twitter and any person 
regarding the user or the user’s Twitter account, including contacts with support 


services, and all records of actions taken, including suspensions of the account. 
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II. Information to be seized by the government 

All information described above in Section I that constitutes fruits, evidence, and 
instrumentalities of violations of 18 U.S.C. § 1030 (fraud and related activities in connection 
with computers) involving since March 1, 2016 including, for each user ID identified on 
Attachment A, information pertaining to the following matters: 

a. Any correspondence regarding hacked emails or other data from the 
Democratic National Committee (DNC) and the email belonging to John 
Podesta (“the email hack”); 

b. Any communications between the Target Accounts and individuals 
associated with the email hack; 

c. Any communications indicating any advance knowledge or direction, 
planning, or control of the email hack; 

d. Evidence indicating how and when the Twitter account was accessed or used, 
to determine the chronological and geographic context of account access, use, 
and events relating to the crime under investigation and to the Twitter account 
owner; 

e. Evidence indicating the Twitter account owner’s state of mind as it relates to 
the crime under investigation; 

f. The identity of the person(s) who created or used the user ID, including 
records that help reveal the whereabouts of such person(s). 

g. The identity of the person(s) who communicated with the accounts about 
matters related to 18 U.S.C. § 1030, including records that help reveal their 


whereabouts. 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT 
FILED 


for the 
District of Columbia AUG 7 
~7 2017 
In the Matter of the Search of ) Clerk, U.S. District and 
(Briefly describe the property to be searched ) ankruptcy Courts 
or identify the person by name and address) ) Case No. 17-MJ-567 

INFORMATION ASSOCIATED WITH THE TWITTER 5 
ACCOUNTS ) 
) 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property to be searched and give its location): 


See Attachment A. 
located in the Northern District of California , there is now concealed (identify the 
person or describe the property to be seized): f ` 


See Attachment B. 
This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
í evidence of a crime; 
Kg contraband, fruits of crime, or other items illegally possessed; 
f property designed for use, intended for use, or used in committing a crime; 
Cl a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. § 1030 Fraud and Related Activities in Connection with Computers 


The application is based on these facts: 


See attached Affidavit. 


( Continued on the attached sheet. 
O Delayed notice of _ days (give exact ending date if more than 30 days: )} is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: A Applicant’s signature 


Mickey Robinson, Special Agent, FB! 


Printed name and title 


Sworn to before me and signed in my presence. 


LE gt th Mw CCE 


Date: 08/07/2017 


Judge's signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Washington, D.C. — 


Printed name and title 
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FILED 


IN THE UNITED STATES DISTRICT COURT 


FOR THE DISTRICT OF COLUMBIA AUG -7 2017 
Clerk, U.S. District and 
IN THE MATTER OF THE SEARCH OF Bankruptcy Courts 


INFORMATION ASSOCIATED WITH THE | Case No. 17-MJ-569 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Mickey Robinson, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 


I, I make this affidavit in support of an application for a search warrant for 


information associated with the Twitter E hereafter “Target Account 
1”) and = QRR “Target Account 2”) and that is stored at premises owned, 
maintained, controlled, or operated by Twitter, a social-networking company headquartered in 
San Francisco, CA. The information to be disclosed by Twitter and searched by the Government 
is described in the following paragraphs and in Attachments A and B. This affidavit is made in 
support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 
2703(c)(1)(A). 

2; I am a Special Agent with Federal Bureau of Investigation (“FBI”) assigned to 
FBI Headquarters working directly with the Special Counsel’s Office. I have been a Special 
Agent with the FBI since 2012. Since then, I have conducted national security investigations of 
foreign intelligence services, espionage, and counter proliferation matters. I have training and 
experience related to foreign intelligence services national security investigations, as well as 
federal financial crimes. I have conducted and participated in various investigations involving 


multiple threat countries as well as national security threats and applicable criminal violations. 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested uae and does not set 
forth all of my knowledge about this matter. 

4, Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that certain individuals with whom Target Account 1 was in 
communication have committed violations of 18 U.S.C.§ 1030 (fraud and related activities in 
connection with computers), and that communications related to these violations will be found 
on the Target Accounts. There is therefore probable cause to search the information described 


in Attachment A for evidence of these crimes and contraband or fruits of these crimes, as 


described in Attachment B. 
JURISDICTION 
5. This Court has jurisdiction to issue the requested warrant because it is “a court of 


competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 2711(3)(A)@). The offense conduct included activities in Washington, D.C., as detailed below 
in paragraphs 6, 20, and 28. 

PROBABLE CAUSE 


A. The 2016 Email Hack and Russia’s Use of “Guccifer 2.0” and Wikileaks to 
Disseminate Hacked Information. 


6. According to the public and unclassified intelligence report conducted by the 


United States Intelligence Community, the Russian military intelligence (General Staff Main 


Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 10 of 21 


Intelligence Directorate or “GRU”) probably began cyber operations aimed at the U.S. election 
by March 2016. The GRU operations resulted in the compromise of the personal e-mail 
accounts of Democratic National Committee (DNC) and other Democratic Party officials and 
political fice’. By May 2016, the GRU had exfiltrated large volumes of data from the DNC. 
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003. 

7. The public and unclassified intelligence report assessed that the GRU used a 
Twitter account, “Guccifer 2.0,” as well as the websitesDCLeaks.com, and WikiLeaks to release 
U.S. victim data obtained in the cyber operations publicly and E E to media outlets. 
Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory 
statements and false claims about his likely Russian identity throughout the election. Press 
reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists. 

B. Roger Stone’s Interactions with Guccifer 2.0 and Wikileaks. 

8. Roger Stone ba self-employed political strategist/consultant and has been 
actively involved in U.S. politics since 1975. Stone worked A the presidential campaign of 
Donald J. Trump (the “Campaign”) until he was fired in August 2015. Although Stone had no 
official relationship with the Campaign thereafter, Stone maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. 

79: As discussed further below, Stone made a number of public references to 
Wikileaks and its release of DNC-related emails. Stone has also E that he was in contact via 
Twitter with Guccifer 2.0. 

10. On June 14, 2016, news reports indicated that the computer systems of the DNC 


had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC 
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hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June, 
21, 2016 release of hacked documents. 

11. On July 22, 2016, Wikileaks published approximately 20,000 emails stolen from 
the DNC. | 

12. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” Stone wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” Stone embedded publicly available Tweets from Guccifer 2.0 in the article and 
wrote: “Here’s Guccifer 2.0’s website. Have a look and you'll see he explains who he is and why 
he did the hack of the DNC.” Stone also stated: “Guccifer 2.0 made a fateful and wise decision. 
He went to Wikileaks with the DNC files and the rest is history. Now the world would see for 
themselves how the Democrats had rigged the game.” 

13. On August 8, 2016, Stone agea the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by Wikileaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard to the 
October surprise, what would be your forecast on that given what Julian Assange has intimated 

he’s going to do?” Stone responded: “Well, it could be a number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days jei Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 


served as an intermediary. 
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14. On August 12, 2016, Guccifer 2.0 publicly tweeted i (Target 


Account 1] thanks that u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released 
the personal cellphone numbers and email addresses from the files of the Democratic 
Congressional Campaign Committee (DCCC). 

15. On August 13, 2016, Stone posted a tweet using Target Account 1 calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

16. On August 14, 2016, Stone sent a private message on Twitter using Target 
Account 1 to Guccifer 2.0, stating he was “delighted” to see the user’s Twitter handle reinstated 
after having been suspended.! 

17. On August 15, 2016, Guccifer 2.0 replied to Soie on Target Account 1, stating: 
“wow. thank u for writing back, and thank u for an article about me!!! did you find anything 
interesting in the docs I posted.” 

18. On August 16, 2016, Stone sent a private message using Target Account 1 
asking Guccifer to retweet an article he had written regarding the ‘rigg[ing]’ of the 2016 


presidential elections. 


19. On August 17, 2016, Guccifer 2.0 publicly tweeted J Target 


Account 1] paying you back.” Guccifer also sent a private message to Target Account 1 stating 
“im pleased to say ur great man. please tell me if I can help u anyhow. it would be a great 


pleasure to me.” 


1 These messages were release by Stone on March 10, 2017, as described further below in paragraph 28. 
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20. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 
Manafort had been involved in using Washington D.C.-based lobbying firms to influence U.S. 
policy toward the Ukraine, including the lobbing group of Anthony Podesta (the brother of John 
Podesta), the Podesta Group. At the same time, press reports indicated that investigators were 
examining Manafort for potential violations of the Foreign Agent Registration Act (FARA), and 
that investigators were also examining the Podesta Group. 

21. On August 21, 2016, using Target Account 1, Stone directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same day, 
Stone reiterated that because of the work of a “‘mutual acquaintance’ of both his and [Assange], 
the public [could] expect to see much more from the exiled whistleblower in the form of 
` strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero. .. I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and alot more. These are like the Watergate tapes.” 

22. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 
that he expected Wikileaks to “drop a payload of new documents on a weekly basis fairly soon. 
And that of course will answer the question of exactly what was erased on that email server.” 

23. On Saturday, October 1, 2016, using Target Account 1, Stone Tweeted, 
“Wednesday @ HillatyClinton is done. #Wikileaks.” 

24. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 


tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
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balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement — 
which was part of Wikileaks’ 10-year anniversary celebration — Stone told Infowars that his 
intermediary described this release as the “mother load.” On Tuesday, October 4, 2016, Stone 
- used Target Account 1 to tweet: “Payload coming. #Lockthemup.” 

25. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a seconded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

26. Approximately a half hour later, at 4:32 P.M., Wikileaks send a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

27. Wikileaks continued to release John Podesta’s hacked emails throughout October 
10-14, 2016. On October 12, 2016, John Podesta — referring back to Stone’s August 21, 2016 C- 
SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - or at 
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails] 
and the Tung campaign had advanced warning about what Assange was going to do. I think 
there’s at least a reasonable belief that [Assange] may have passed this information on to 
[Stone].” Commenting to the Miami Herald, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 


deleted. I hear that through my emissary.” 
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28. On March 10, 2017, Stone spoke with The Washington Times and acknowledged 
he had been in contact with Guccifer 2.0 using Target Account 1. Stone publicly stated that he 
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter’s 
private message system to do so. Stone provided a copy of the private messages to The 
Washington Times. 

‘29. Onor about May 12, 2017, United States Magistrate Judge Michael S. 
Nachmanoff of the Eastern District of Virginia issued an Order pursuant to 18 U.S.C. § 2705(b) 
requiring Twitter to disclose certain records, including subscriber and user activity information, 
associated with the Target Accounts described above (Case number 17-GJ-0835). On or about 
May 23, 2017, Twitter provided the FBI with records that confirmed that the Target Accounts 
are registered to Stone. | 

30. As described above, it appears that Stone has used the private messaging function 
of Target Account 1 to communicate with Guccifer 2.0. I know in my training and experience 
that individuals with multiple accounts on the same service, such as Stone has on Twitter, often 
use both accounts for their communications. A review of Target Account 2’s publicly available 
omaro indicates that it has been in use since November 2015. Stone also appears to 
comment using Target Account 2 frequently. Stone also often publicly “Retweets” messages 
using Target Account 2 which originated from Target Account 1. Therefore there is probable 
cause to believe that messages pertaining to the investigation, including messages to individuals 
regarding the hack, as well as communications with Guccifer 2.0, will be found on Target 


Account 1 and Target Account 2. 


INFORMATION CONCERNING TWITTER 
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31. Twitter owns and operates a free-access social-networking website of the same 
faite that can be accessed at http://www.twitter.com. Twitter allows its users to create their own 
profile pages, which can include a short biography, a photo of themselves, and location 
information. Twitter also permits users to create and read Ater messages called 
“Tweets,” and to restrict their “Tweets” to individuals whom they approve. These pater are 
described in more detail below. 

32. Upon creating a Twitter account, a Twitter user must create a unique Twitter 
username and an account password, and the user may also select a different name of 20 
characters or fewer to identify his or her Twitter account. The Twitter user may also change this 
username, password, and name without having to open a new Twitter account. 

33. Twitter asks users to provide basic identity and contact information, either during 
the registration process or thereafter. This information may include the user’s full name, e-mail 
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown, 
occupation, and other personal identifiers. For each user, Twitter may retain information about 
the date and time at which the user’s profile was created, the date and time at which the account 
was created, and the Internet Protocol (“IP”) address at the time of sign-up. Because every 
device that connects to the Internet must use an IP address, IP address information can help to 
identify which computers or other devices were used to access a given Twitter account. 

34. A Twitter user can post a personal photograph or image (also known as an 
“avatar”) to his or her profile, and can also change the profile background or theme for his or her 


account page. In addition, Twitter users can post “bios” of 160 characters or fewer to their profile 


pages. 


Case 1:19-mc-00029-CRC Document 29-1 Filed 04/28/20 Page 17 of 21 


35. Twitter also keeps IP logs for each user. These logs contain information about the 
- user’s logins to Twitter including, for each access, the IP address assigned to the user and the 
date stamp at the time the user accessed his or her profile. 

36. As discussed above, Twitter users can use their Twitter accounts to post “Tweets” 
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was 
posted to Twitter. Twitter users can also “favorite,” “retweet,” or reply to the Tweets of other 
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign, 
Twitter designates that Tweet a “mention” of the identified user. In the “Connect” tab for each 
account, Twitter provides the user with a list of other users who have “favorited” or “retweeted” 
the user’s own Tweets, as well as a list of all Tweets that include the user’s username (i.e., a list 
of all “mentions” and “replies” for that username). 

37. Twitter users can include photographs or images in their Tweets. Each Twitter 
account also is provided a user gallery that includes images that the user has shared on Twitter, 
including images uploaded by other services. 

38. Twitter users can also opt to include location data in their Tweets, which will 
reveal the users’ locations at the time they post each Tweet. This “Tweet With Location” 
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users 
may delete their past location data. 

39. | When Twitter users want to post a Tweet that includes a link to a website, they 
can use Twitter’s link service, which converts the longer wiebsite Hak into a shortened link that 
begins with http://t.co. This link service measures how many times a link has been clicked. 

40. A Twitter user can “follow” other Twitter users, which means subscribing to 


those users’ Tweets and site updates. Each user profile page includes a list of the people who are 
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following that user (i.e., the user’s “followers” list) and a list of people whom that user follows 
(i.e., the user’s “following” list). Twitters users can “unfollow” users Whom they previously 
followed, and they can also adjust the privacy settings for their profile so that their Tweets are 
visible only to the people whom they approve, rather than to the public (which is the default 
setting). A Twitter user can also group other Twitter users into “lists” that display on the right 
side of the user’s home page on Twitter. Twitter also provides users with a list of “Who to 
Follow,” which includes a few recommendations of Twitter accounts that the user may find 
interesting, based on the types of accounts that the user is already following and who those 
people follow. 

41. In addition to posting Tweets, a Twitter user can also send DMs to one of his or 
her followers. These messages are typically visible only to the sender and the recipient, and both 
the sender and the recipient have the power to delete the message from the inboxes of both users. 
As of January 2012, Twitter displayed only the last 100 DMs for a particular user, but older DMs 
are stored on Twitter’s database. 

42. Twitter users can configure the settings for their Twitter accounts in numerous 
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the 
user’s mobile phone, and the user can also set up a “sleep time” during which Twitter updates 
will not be sent to the user’s phone. 

43. Twitter includes a search function that enables its users to search all public 
Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to 


25 past searches. 
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44. Twitter users can connect their Twitter accounts to third-party websites and 
applications, which may grant these websites and applications access to the users’ public Twitter 
profiles. | | 

45. If a Twitter user does not want to interact with another user on Twitter, the first 
user can “block” the second user from following his or her account. 

46. In some cases, Twitter users may communicate directly with Twitter about issues 
relating to their account, such as technical problems or complaints. Social-networking providers 
like Twitter typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. Twitter may also suspend a particular user 
for breaching Twitter’s terms of service, during which time the Twitter user will be prevented 
from using Twitter’s services. 

47. As explained herein, information stored in connection with a Twitter account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Twitter user’s account information, IP log, stored electronic communications, and other data 
retained by Twitter, can indicate who has used or controlled the Twitter account. This “user 
attribution” evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence. For example, profile contact information, communications, 
“tweets” (status updates) a “tweeted” photos (and the data associated with the foregoing, such 
as date and time) may be evidence of who used or controlled the Twitter account at a relevant 


time. Further, Twitter account activity can show how and when the account was accessed or 
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used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from 
which users access their accounts along with the time and date. By determining the physical 
location associated with the logged IP addresses, investigators can understand the chronological 
and geographic context of the account access and use relating to the crime under investigation. 
Such information allows investigators to understand the geographic and chronological context of 
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter 
builds geo-location into some of its services. If enabled by the user, physical location is 
automatically added to “tweeted” communications. This geographic and timeline information 
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account 
activity may provide relevant insight into the Twitter account owner’s state of mind as it relates 
to the offense under investigation. For example, information on the Twitter account may 
indicate the owner’s motive and intent to commit a crime (e.g., information indicating a criminal 
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal 
evidence from law enforcement). 

48. Therefore, the computers of Twitter are likely to contain all the material described 
above, including stored electronic communications and information concerning subscribers and 
their use of Twitter, such as account access A E transaction information, and other 
account information. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

49. J anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Twitter to disclose to the government copies of the records and other information 


(including the content of communications) associated with the accounts in Attachment A and 
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particularly described in Section I of Attachment B. Upon receipt of the information described in 
Section I of Attachment B, government-authorized persons will review that information to locate 
the items described in Section II of Attachment B. 
CONCLUSION 

50. Based on the forgoing, I request that the Court issue the proposed search warrant. - 

51. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

52. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these | 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Mickey Me 


Special Agent 
Federal Bureau of Investigation 


7^ 
Subscribed and sworn to before me on this day of August, 2017. 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 


District of Cahiımhia 


In the Matter of the Search of ) Case: 1:17-mj-00661 
(Briefly describe the property to be searched ) Assigned To : Howell, Beryl A. 
or identify the person by name and address) ) Assian. Date : 9/11/201 7 
INFORMATION ASSOCIATED WITH THE EMAIL ) Description: Search & Seizure Warrant 
ACCOUNT 
SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California 
(identify the person or describe the property to be searched and give its location): 


See Attachment A. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B. 


YOU ARE COMMANDED to execute this warrant on or before September 25, 2017 (not to exceed 14 days) 
@ in the daytime 6:00 a.m. to 10:00 p.m. Oat any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 


O for days (not to exceed 30) C until, the facts justifying, the later specific date of 


Date and time issued: booki MA CTA 2 Ml: A LBA " VOLA ae 


dge’s signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


— Date and time warrant executed: Copy of warrant and inventory left with: 
Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalt 


y of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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AO 106 (Rev. 04/10) Application for a Search Warrant sae ad 


UNITED STATES DISTRICT COURT stp ; 4 py 
for the a 
District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH THE EMAIL 
ACCOUNT 


Case: 1:17-mj-00661 
Assigned To : Howell. Beryl A. 
Assian. Date : 9/11/2017 


Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 
located in the Northern District of California , there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment B 


This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 
Wf contraband, fruits of crime, or other items illegally possessed; 
@ property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. § 1030; Fraud and related activities in connection with computers 
18 U.S.C. § 371 Conspiracy to commit an offense against the United States 


The application is based on these facts: 
See attached Affidavit. 


Æ Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: Applicant’s signature 


Aaron Zelinsky (ASC) Amy Anderson, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


Date: 09/11/2017 E ie AM 2 EH. flier 


Judge's signature 


City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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IN THE UNITED STATES DISTRICT COURT Pp 4 san 
FOR THE DISTRICT OF COLUMBIA g raii 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH THE 
EMAIL ACCOUNT 


Case No. 


Filed Under Seal 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Amy Anderson, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

l; I make this affidavit in support of an application for a search warrant for 
information associated with the Email Account a (hereafter the “Target 
Account”), that is stored at premises owned, maintained, controlled, or operated by Microsoft 
Corp., d/b/a Hotmail, an email provider headquartered at One Microsoft Way, Redmond, WA 
98052 (hereinafter “Microsoft”). The information to be disclosed by Microsoft and searched by 
the Government is described in the following paragraphs and in Attachments A and B. This 
affidavit is made in support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 
2703(b)(1)(A), and 2703(c)(1)(A). 

2. I am a Special Agent with Federal Bureau of Investigation (“FBI”) assigned to 
FBI Headquarters working — with the Special Counsel’s Office. I have been a Special 
Agent with the FBI since 2010. Since then, I have conducted national security investigations of 
foreign intelligence services, espionage, and counter proliferation matters. I have training and 
experience related to espionage and foreign intelligence services national security investigations. 
I have conducted and participated in various investigations involving multiple threat countries as 


well as national security threats and applicable criminal violations. 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4, Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contains communications relevant to 
violations of 18 U.S.C.§ 1030 (fraud and related activities in connection with computers) and 18 
U.S.C. § 371 (conspiracy to commit an offense against the United States). As set forth below, 
Roger Stone used Twitter’s private direct messaging function to message Wikileaks, Julian 
Assange, and Guccifer 2.0, a Twitter account used by Russian intelligence to disseminate hacked 
information. Stone also repeatedly used Twitter’s private direct messaging function to instruct 
individuals to email him on the Target Account to continue conversations begun on Twitter’s 
private direct messaging system. These conversations included discussion of information related 
to the Campaign and potential derogatory information concerning a presidential candidate in the 
Republican primary. There is therefore probable cause to search the information described in 
Attachment A for evidence of these crimes and contraband or fruits of these crimes, as described 
in Attachment B. 

JURISDICTION 

$. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 


such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
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§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below 
in paragraphs 6, 20, and 28. 
PROBABLE CAUSE 


A. The 2016 Email Hack and Russia’s Use of “Guccifer 2.0” and Wikileaks to 
Disseminate Hacked Information. 


6. According to the public and unclassified intelligence report conducted by the 
United States Intelligence Community, the Russian military intelligence (General Staff Main 
Intelligence Directorate or “GRU”) probably began cyber operations aimed at the U.S. election 
by March 2016. The GRU operations resulted in the compromise of the personal e-mail 
accounts of Democratic National Committee (DNC) and other Democratic Party officials and 
political figures. By May 2016, the GRU had exfiltrated large volumes of data from the DNC. 
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003. 

Te The public and unclassified intelligence report assessed that the GRU used a 
Twitter account, “Guccifer 2.0,” as well as the websitesDCLeaks.com, and WikiLeaks to release 
U.S. victim data obtained in the cyber operations publicly and in exclusives to media outlets. 
Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory 
statements and false claims about his likely Russian identity throughout the election. Press 
reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists. 

B. Roger Stone’s Publicly Disclosed Interactions with Guccifer 2.0 and Wikileaks. 

8. Roger Stone is a self-employed political strategist/consultant and has been 

actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of 


Donald J. Trump (the “Campaign”) until he was fired in August 2015. Although Stone had no 


Case 1:19-mc-00029-CRC Document 29-2 Filed 04/28/20 Page 7 of 23 


official relationship with the Campaign thereafter, Stone maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. 

9. As discussed further below, Stone made ‘a number of public references to 
Wikileaks and its release of DNC-related emails. Stone has also stated that he was in contact via 
Twitter with Guccifer 2.0. 

10. On June 14, 2016, news reports indicated that the computer systems of the DNC 
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC 
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June, 
21, 2016 release of hacked documents. 

11. On July 22, 2016, Wikileaks published approximately 20,000 emails stolen from 
the DNC. 

12. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” Stone wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” Stone embedded publicly available Tweets from Guccifer 2.0 in the article and 
wrote: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and why 
he did the hack of the DNC.” Stone also stated: “Guccifer 2.0 made a fateful and wise decision. 
He went to Wikileaks with the DNC files and the rest is history. Now the world would see for 
themselves how the Democrats had rigged the game.” 

13. On August 8, 2016, Stone addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by Wikileaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 


at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard to the 
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October surprise, what would be your forecast on that given what Julian Assange has intimated 
he’s going to do?” Stone responded: “Well, it could be a number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 
served as an intermediary. 

14. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the Democratic Congressional Campaign 
Committee (DCCC). 

15: On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
Twitter account was reinstated. 

16. On August 14, 2016, Stone sent a private message on Twitter using 
@RogerJStoneJr to Guccifer 2.0, stating he was “delighted” to see the user’s Twitter handle 
reinstated after having been suspended.! 

17. On August 15, 2016, Guccifer 2.0 replied to Stone on Target Account 1, stating: 
“wow. thank u for writing back, and thank u for an article about me!!! did you find anything 


interesting in the docs I posted.” 


! These messages were released by Stone on March 10, 2017, as described further below in paragraph 28. 
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18. On August 16, 2016, Stone sent a private message using @RogerJStoneJr asking 
Guccifer to retweet an article he had written regarding the ‘rigg|ing]’ of the 2016 presidential 
elections. 

19. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “im pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

20. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 
Manafort had been involved in using Washington D.C.-based lobbying firms to influence U.S. 
policy toward the Ukraine, including the lobbing group of Anthony Podesta (the brother of John 
Podesta), the Podesta Group. At the same time, press reports indicated that investigators were 
examining Manafort for potential violations of the Foreign Agent Registration Act (FARA), and 
that investigators were also examining the Podesta Group. 

21. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” Ina C-SPAN interview that same day, 
Stone reiterated that because of the work of a “‘mutual acquaintance’ of both his and [Assange], 
the public [could] expect to see much more from the exiled whistleblower in the form of 
strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 


Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 
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22. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 
that he expected Wikileaks to “drop a payload of new documents on a weekly basis fairly soon. 
And that of course will answer the question of exactly what was erased on that email server.” 

23: On Saturday, October 1, 2016, using @RogerJStoneJr, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. #Wikileaks.” 

24. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement — 
which was part of Wikileaks’ 10-year anniversary celebration — Stone told Infowars that his 
intermediary described this release as the “mother load.” On Tuesday, October 4, 2016, Stone 
used @RogerJStoneJr to tweet: “Payload coming. #Lockthemup.” 

25. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

26. Approximately a half hour later, at 4:32 P.M., Wikileaks send a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

27. Wikileaks continued to release John Podesta’s hacked emails throughout October 
10-21, 2016. On October 12, 2016, John Podesta — referring back to Stone’s August 21, 2016 C- 
SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - or at 
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails] 
and the Trump campaign had advanced warning about what Assange was going to do. I think 


there’s at least a reasonable belief that [Assange] may have passed this information on to 
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[Stone].” Commenting to the Miami Herald, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he | 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 

28. On March 10, 2017, Stone spoke with The Washington Times and acknowledged 
he had been in contact with Guccifer 2.0 using @RogerJStoneJr. Stone publicly stated that he 
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter’s 
private message system to do so. Stone provided a copy of the private messages to The 
Washington Times. 

29. On March 27, 2017, CNN reported that a representative of Wikileaks, writing 
from an email address associated with Wikileaks, denied that there was any backchannel 
communication during the Campaign between Stone and Wikileaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

C. Roger Stone’s Private Twitter Direct Messages with Wikileaks and Julian Assange. 

30. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. While the full review of that returned information is ongoing, 
the initial review indicates that, contrary to Stone’s representation to CNN that he “never 


communicated with WikiLeaks,” Stone in fact communicated via private direct messaging with 
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Wikileaks during the Campaign. Stone also used the @RogerJStoneJr Twitter account’s private 
direct messaging system to communicate directly with Julian Assange since at least June 2017. 

3i, For example, on October 13, 2016, while Wikileaks was in the midst of releasing 
the hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@Wikileaks. This account is the official Twitter account of Wikileaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending wikileaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

32. Less than an hour later, @Wikileaks responded by direct message: “We 
appreciate that. However, the false claims of association are being used by the democrats to 
undermine the impact of our publications. Don't go there if you don't want us to correct you.” 

33. On October 16, 2016, @RogerJStoneJr sent a direct message to @ Wikileaks: 
“Ha! The more you \"correct\" me the more people think you're lying. Your operation leaks like 
a sieve. You need to figure out who your friends are.” 

34. On November 9, 2016, one day after the presidential election, @Wikileaks sent a 
direct message to @RogerJStoneJr containing a single word: “Happy?” @Wikileaks 
immediately followed up with another message less than a minute later: “We are now more free 
to communicate.” 

35. In addition, @RogerJStoneJr has also recently exchanged direct messages with 
Julian Assange, the founder of Wikileaks. For example, on June 4, 2017, @RogerJStoneJr 
directly messaged @JulianAssange, an address associated with Julian Assange in numerous 


public reports, stating: “Still nonsense. As a journalist it doesn't matter where you get 
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information only that it is accurate and authentic. The New York Times printed the Pentagon 
Papers which were indisputably stolen from the government and the courts ruled it was legal to 
do so and refused to issue an order restraining the paper from publishing additional articles. If 
the US government moves on you I will bring down the entire house of cards. With the trumped- 
up sexual assault charges dropped I don't know of any crime you need to be pardoned for - best 
regards. R.” That same day, @JulianAssange responded: “Between CIA and DoJ they're doing 
quite a lot. On the DoJ side that's coming most strongly from those obsessed with taking down 
Trump trying to squeeze us into a deal.” 

36. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@Wikileaks, reading: “I am doing everything possible to address the issues at the highest level 
of Government. Fed treatment of you and Wikileaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 


D. Roger Stone’s Use of the Target Account to Continue Conversations Begun on 
Twitter Direct Message. 


37. Using the direct messaging function associated with the account @RogerJStoneJr, 
Stone sent direct messages to individuals instructing them to email the Target Account to 
continue conversations began via Twitter direct message. For example, on August 8, 2015, an 
individual sent @RogerJStoneJr a direct message asking if he had “a few minutes this afternoon 
to talk about all of today’s drama with Trump.” Stone responded the next day: “Sorry I missed 
this — my email [Target Account].” 

38. On August 8, 2015, an individual sent a direct message to @RogerJStoneJr 
reading: “J ust got some stuff from the campaign you may want to respond to.” That same day, 


@RogerJStoneJr responded: “Such as -? My email is [Target Account].” 
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39. On August 9, 2015, an individual sent @RogerJStoneJr a direct message asking to 
arrange an interview. @RogerJStoneJr replied, “Okay — what do you need from me.” The 
individual replied, “Your email address. Twitter too public.” Stone replied with the Target 
Account. 

40. | On September 7, 2015, an individual sent a private direct message to 
@RogerJStoneJr containing a “White Paper,” regarding the “Most likely questions to be asked of 
Mr. Trump on Foreign Policy.” @RogerJStoneJr replied: “Send to me at [Target Account].” 

41. On February 17, 2016, an individual sent a direct message to Stone reading: “Mr. 
Stone I have a delightful story about one foul tempered governor currently pretending to be Ned 
Flanders up on the stage. Interested?” @RogerJStoneJr responded on Friday, February 19, 2016: 
“Sure---tell me what u know—[Target Account].” 

42. On March 21, 2016, an individual sent a private direct message to 
@RogerJStoneJr reading: “Im trying to get a list of upcoming Trump events so I can Fly out and © 
Film these Anti-Trump protesters. To show the American people that these are the people that 
are actually creating the Chaos. No one is showing whats really going on outside at these events 
honestly and quite frankly its pissing me off.” The next day, @RogerJStoneJr responded: “Email 
me at [Target Account].” 

43. On April 30, 2016, an individual sent a private direct message to @RogerJStoneJr 
stating: “Give me a shout if you need a story moved. My followers are RTing fiends! lol.” 
@RogerJStoneJr responded: “Great- please e-mail me again at [Target Account].” 

44. On September 13, 2016, an individual send a private direct message to 
@RogerJStoneJr asking for a “contact info so I can stay in touch in a more appropriate way than 


Twitter DM.” @RogerJStoneJr replied, “email me at [Target Account].” 
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BACKGROUND CONCERNING HOTMAIL 

45. In my training and experience, I have learned that Microsoft provides a variety of 
on-line services, including electronic mail (“email”) access, to the public. Microsoft allows 
subscribers to obtain email accounts at the domain name Hotmail.com, like the email account 
listed in Attachment A. Subscribers obtain an account by registering with Hotmail. During the 
registration process, Hotmail asks subscribers to provide basic personal information. Therefore, 
the computers of Microsoft are likely to contain stored electronic communications (including 
retrieved and unretrieved email for Hotmail subscribers and information concerning subscribers 
and their use of Hotmail services, such as account access information, email transaction 
information, and account application information. In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. 

46. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

47. In my training and experience, email providers typically retain certain 


transactional information about the creation and use of each account on their systems. This 
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information can include the date on which the account was created, the length of service, records 
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account 
‘(including whether the account is inactive or closed), the methods used to connect to the account 
(such as logging into the account via the provider’s website), and other log files that reflect usage 
of the account. In addition, email providers often have records of the Internet Protocol address 
(“IP address”) used to register the account and the IP addresses associated with particular logins 
to the account. Because every device that connects to the Internet must use an IP address, IP 
address information can help to identify which computers or other devices were used to access 
the email account. 

48. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and 
the provider’s support services, as well as records of any actions taken by the provider or user as 
a result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

49. This application seeks a warrant to search all responsive records and information 
under the control of Microsoft, a provider subject to the jurisdiction of this court, regardless of 
where Microsoft has chosen to store such information. The government intends to require the 
disclosure pursuant to the requested warrant of the contents of wire or electronic 
communications and any records or other information pertaining to the customers or subscribers 


if such communication, record, or other information is within Microsoft’s possession, custody, or 
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control, regardless of whether such communication, record, or other information is stored, held, 
or maintained outside the United States. 

50. As explained herein, information stored in connection with an email account 
may provide crucial evidence of the “who, what, why, when, where, and how” of the criminal 
conduct under investigation, thus enabling the United States to establish and prove each element 
or alternatively, to exclude the innocent from further suspicion. In my training and experience, 
the information stored in connection with an email account can indicate who has used or 
controlled the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, 
information maintained by the email provider can show how and when the account was accessed 
or used. For example, as described below, email providers typically log the Internet Protocol 
(IP) addresses from which users access the email account, along with the time and date of that 
access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time (e.g., location information integrated into an image or video sent 
via email). Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 


the email account may indicate the owner’s motive and intent to commit a crime (e.g., 
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communications relating to the crime), or consciousness of guilt (e.g., deleting communications 
in an effort to conceal them from law enforcement). 
INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

51. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Hotmail to disclose to the government copies of the records and other information 
(including the content of communications) associated with the account in Attachment A and 
particularly described in Section I of Attachment B. Upon receipt of the information described in 
Section I of Attachment B, government-authorized persons will review that information to locate 
the items described in Section II of Attachment B. The items identified in Attachments A and B 
will also be screened by reviewers not on the prosecution team to identify andilter out privileged 
material. 

CONCLUSION 

52. Roger Stone used the @RogerJStoneJr to communicate directly with Wikileaks 
during the campaign, even though he publicly claimed to have “never” communicated with 
Wikileaks. He also sent private messages to Julian Assange and Guccifer 2.0, the entity which 
claimed responsibility for the DNC hack. Using @RogerJStoneJr, Stone has repeatedly 
instructed individuals to continue conversations, including particularly sensitive issues related to 
the Campaign, on the Target Account. There is therefore probable cause to believe that 
evidence of the DNC hack and the hacking of other emails associated with the 2016 election will 
be found on the Target Account. 


53. Based on the forgoing, I request that the Court issue the proposed search warrant. 
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54. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 

required for the service or execution of this warrant. 
REQUEST FOR SEALING 

55. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the ihvestivation, Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Amy Andé}son 
Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this Ol aa of September, 2017. 


- 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to Be Searched 


This warrant applies to information associated with the [J Account 


GE (the “Target Account”) that is stored at premises owned, maintained, 


controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered at One 


Microsoft Way, Redmond, WA 98052. 
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I. 


ATTACHMENT B 


Information to be disclosed by Microsoft, Corp. 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of the Microsoft, Corp. (hereinafter “the Provider”), regardless of whether 


such information is stored, held or maintained inside or outside of the United States, and 


including any emails, records, files, logs, or information thal has been deleted but is still 


available to the Provider, the Provider is required to disclose the following information to the 


government for each account or identifier listed in Attachment A2: 


a. 


The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account, draft emails, the source 
and destination addresses associated with each email, the date and time at which 
each email was sent, and the size and length of each email; 

All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP 
addresses associated with session times and dates, account status, alternative 
email addresses provided during registration, methods of connecting, log files, 
and means and source of payment (including any credit or bank account number); 
The types of service utilized; 

All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the 
date on which the account was created, the length of service, the types of service 
utilized, the IP address used to register the account, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided 
during registration, all other user names associated with the account, all account 


names associated with the subscriber, methods of connecting; 
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Il. 


All search history or web history; 

All records indicating the services available to subscribers of the account; 

All usernames associated with or sharing a login IP address or browser cookie 
with the account; 

All cookies, including third-party cookies, associated with the user; 

All records that are associated with the machine cookies associated with the user; 
and 

All telephone or instrument numbers associated with the Account (including 
MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity 
Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile 
Identification Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile 
Subscriber Integrated Services Digital Network Number (“MSISDN”), 
International Mobile Subscriber Identifiers (“IMSI”), or International Mobile 


Equipment Identities (“IMEI”). 


Information to be Seized by the Government 


All information described above in Section I that constitutes evidence, contraband, fruits, 


and/or instrumentalities of violations of 18 U.S.C. § 1030 (fraud and related activities in 


connection with computers) and 18 U.S.C. §371 (conspiracy to commit and offense against the 


United States) involving Roger Stone or others associated with him and occurring after January 


1, 2015, including, for each account or identifier listed on Attachment A, information pertaining 


to the following matters: 


(a) 


(b) 


Communications, records, documents and other files that reveal efforts by Roger 
Stone to communicate with any individuals associated with carrying out the hacks 
of the DNC or individual email addresses associated with the Clinton Campaign. 
Records of any funds or benefits received by or offered to Roger Stone or an 
individuals or entities associated with him by, or on behalf of, any individuals 
associated with the hacks of the DNC or individual email addresses associated 


with the Clinton Campaign. 
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(c) 


(d) 


(e) 


(f) 


Evidence indicating how and when the account was accessed or used, to 
determine the geographic and chronological context of account access, use, and 
events relating to the crimes under investigation and to the account owner; 
Evidence indicating the account owner’s state of mind as it relates to the crimes 
under investigation; 

The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s). 

The identity of any person(s)—including records that help reveal the person(s)’ 
whereabouts—who communicated with the account about any matters relating to 
activities conducted by Roger Stone on behalf of, for the benefit of, any 
individual associated with hacks of the DNC or individual email addresses 


associated with the Clinton Campaign. 


Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 1 of 25 


AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 

In the Matter of the Search of . 
e ty ies noe ipe ) Case: 1:17-mj-00760 

iefly describe the property to be searched ) ; 
or identify the person by name and address) ) Assigned To : Howell, Beryl A. 

INF ) Assign. Date : 10/17/2017 

a are E tes ) Description: Search and Seizure Warrant 
) 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern Districtof California 


(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before October 31,2017 (not to exceed 14 days) 
M in the daytime 6:00 a.m. to 10:00 p.m. (at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell _ = 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) © until, the facts justifying, the later specific date of < 7 


Date and time issued: Aha ZL: 2d f al J? 3 ISRA, E SEPT A hin @G 


Judge's signature 


Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: 
Printed name and title 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the following Google account: 


that is stored at premises owned, maintained, controlled, or operated by Google, Inc., a business 


with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT B 
Particular Things to be Seized 


L Files and Accounts to be produced by Google, Inc. between January 1, 2015 and 
the Present. 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment A: 


a. The contents of all e-mails, attachments and chat messages stored in the 
account, including copies of e-mails sent to and from the account, draft e-mails, the 
source and destination e-mails sent addresses associated with each e-mail, the date and 
time at which each e-mail was sent, and the size and length of each e-mail; 


b. All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 


c. All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 


e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 


f. All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 


g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section I.A.; 


h. Google+ subscriber information, circle information, including name of 
circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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i. Google Drive files created, accessed or owned by the account; 


j. YouTube subscriber information, private videos and files, private 
messages, and comments; 


k. Google+ Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 


L Google Talk and Google Hangouts conversation logs associated with the 
account. 
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06 (Rev. 04/10) Application for a Search Warrant i y i E D 


UNITED STATES DISTRICT COURT OCT 17 2017 
for the : 
ra ; Clerk, U.S. District & Bankruptcy 
District of Columbia Courts for the District of Columbla 
In the Matter of the Search of ) Case: 1:17-mj-00760 
or enti the person byname and address) } Assigned To : Howell, Beryl A. 
INFORMATION ASSOCIATED WITH ) Assign. Date : 10/1 7/2017 
; Description: Search and Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property to be searched and give its location): 


See Attachment A. 
located inthe _ Northern District of California , there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment B. 


This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
{í evidence of a crime; 
Wf contraband, fruits of crime, or other items illegally possessed; 
Mí property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. § 1030 Fraud and Related Activities in Connection with Computers Agents 
18 U.S.C. § 2 Aiding and Abetting 
22 U.S.C. § 371 Conspiracy to Commit an Offense Against the United States 


The application is based on these facts: 


See attached Affidavit. 


Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: í, Applicant’s signature 


Amy Anderson, Special Agent, FBI 


Printed name and title 


Aaron Zelinsky (ASC) 


Sworn to before me and signed in my presence. 


Date: 10/17/2017 LET. Fog ah 


Judge's signature 


City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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OCT 1 7 2017 
IN THE UNITED STATES DISTRICT COURT Clerk, U.S. District & Bankruptcy 
FOR THE DISTRICT OF COT TIIMRIA Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF Case: 1:17-mj-00760 


Assigned To : Howell, Beryl A. 
INFORMATION ASSOCIATED WITH Assign. Date : 10/17/2017 


Description: Search and Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Amy Anderson, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

i; I make this affidavit in support of an application for a search warrant for 
information associated with the email account (hereafter the “Target 
Account”), that is stored at premises owned, maintained, controlled, or operated by Google, 
Inc., a business with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 
The information to be disclosed by Google and searched by the government is described in the 
following paragraphs and in Attachments A and B. This affidavit is made in support of an 
application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 

2, I am a Special Agent with Federal Bureau of Investigation (“FBI”) assigned to 
FBI Headquarters working directly with the Special Counsel’s Office. I have been a Special 
Agent with the FBI since 2010. Since then, I have conducted national security investigations of 
foreign intelligence services, espionage, and counter proliferation matters. I have training and 
experience related to espionage and foreign intelligence services national security investigations. 
I have conducted and participated in various investigations involving multiple threat countries as 
well as national security threats and applicable criminal violations. 

3s The facts in this affidavit come from my personal observations, my training and 


experience, and information obtained from other agents and witnesses. This affidavit is intended 
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to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contains communications relevant to 
violations of 18 U.S.C. § 1030 (fraud and related activities in connection with computers), 18 
U.S.C. § 2 (aiding and abetting), and 18 U.S.C. § 371 (conspiracy to commit an offense against 
the United States). 

5. As set forth below, Roger STONE communicated directly via Twitter with 
WikiLeaks, Julian Assange, and Guccifer 2.0, a Twitter account used by Russian intelligence to 
disseminate hacked information. STONE, using his [J Account, also emailed instructions 
to Jerome CORSI to “Get to Assange” in person at the Ecuadorian Embassy and “get pending 
WikiLeaks emails[.]” CORSI emailed STONE back on his {J Account that it was “Time 
to let more than Podesta to be exposed” (before any of Podesta’s were leaked). After Podesta’s 
emails were leaked, CORSI emailed STONE “talking points” about Podesta to the Target 
Account. CORSI also emailed the Target Account to convey information “from a very trusted 
source” regarding Julian ASSANGE, WikiLeaks, and potential future disclosures. In addition, 
STONE used the Target Account to continue conversations via email that he began on Twitter 


and forwarded emails, including at least one related to WikiLeaks, from his [J account to 


the Target Account. 
JURISDICTION 
6. This Court has jurisdiction to issue the requested warrant because it is “a court of 


competent jurisdiction” as defined by 18 U.S.C. § 2711. Jd. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 


Specifically, the Court is “a district court of the United States (including a magistrate judge of 
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such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 2711(3)(A)(). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraph 7. 

PROBABLE CAUSE 


A. The 2016 Email Hack and Russia’s Use of “Guccifer 2.0” and WikiLeaks to 
Disseminate Hacked Information. 


T According to the public and unclassified intelligence report conducted by the 
United States Intelligence Community, the Russian military intelligence (General Staff Main 
Intelligence Directorate or “GRU”) probably began cyber operations aimed at the U.S. election 
by March 2016. The GRU operations resulted in the compromise of the personal e-mail 
accounts of Democratic National Committee (DNC) and other Democratic Party officials and 
political figures. By May 2016, the GRU had exfiltrated large volumes of data from the DNC. 
The DNC headquarters is located at 430 South Capitol Street SE, Washington, D.C. 20003. 

8. The public and unclassified intelligence report assessed that the GRU used a 
Twitter account, “Guccifer 2.0,” as well as the websitesDCLeaks.com, and WikiLeaks to release 
U.S. victim data obtained in the cyber operations publicly and in exclusives to media outlets. 
Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory 
statements and false claims about his likely Russian identity throughout the election. Press 
reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists. 

B. Roger Stone’s Publicly Disclosed Interactions with Guccifer 2.0 and WikiLeaks. 

9, Roger Stone is a self-employed political strategist/consultant and has been 

actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of 


Donald J. Trump (the “Campaign”) until he was fired in August 2015. Although Stone had no 
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official relationship with the Campaign thereafter, Stone maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. 

10. As discussed further below, Stone made a number of public references to 
WikiLeaks and its release of DNC-related emails. Stone has also stated that he was in contact via 
Twitter with Guccifer 2.0. 

11. On June 14, 2016, news reports indicated that the computer systems of the DNC 
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC 
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June, 
21, 2016 release of hacked documents. 

12. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

13. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” Stone wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” Stone embedded publicly available Tweets from Guccifer 2.0 in the article and 
wrote: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and why 
he did the hack of the DNC.” Stone also stated: ““Guccifer 2.0 made a fateful and wise decision. 
He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for 
themselves how the Democrats had rigged the game.” 

14. On August 8, 2016, Stone addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 


at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard to the 
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October surprise, what would be your forecast on that given what Julian Assange has intimated 
he’s going to do?” Stone responded: “Well, it could be a number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 
served as an intermediary. 

15. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the Democratic Congressional Campaign 
Committee (DCCC). 

16. On ae 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
Twitter account was reinstated. 

i On August 14, 2016, Stone sent a private message on Twitter using 
@RogerJStoneJr to Guccifer 2.0, stating he was “delighted” to see the user’s Twitter handle 
reinstated after having been suspended.! 

18. On August 15, 2016, Guccifer 2.0 replied to Stone at @RogerJStoneJr, stating: 
“wow. thank u for writing back, and thank u for an article about me!!! did you find anything 


interesting in the docs I posted.” 


Egl 
' These messages were released by Stone on March 10, 2017, as described further below in paragraph 28: ad 
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19. On August 16, 2016, Stone sent a private message using @RogerJStoneJr asking 
Guccifer to retweet an article he had written regarding the ‘rigg[ing]’ of the 2016 presidential 
elections. 

20. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

PA On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 
Manafort had working with a Washington D.C.-based lobbying firms to influence U.S. policy 
toward Ukraine. 

22. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same day, 
Stone reiterated that because of the work of a “‘mutual acquaintance’ of both his and [Assange], 
the public [could] expect to see much more from the exiled whistleblower in the form of 
strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

23. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 
that he expected WikiLeaks to “drop a payload of new documents on a weekly basis fairly soon. 


And that of course will answer the question of exactly what was erased on that email server.” 
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24. On Saturday, October 1, 2016, using @RogerJStoneJr, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

25. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement — 
which was part of WikiLeaks’ 10-year anniversary celebration — Stone told Infowars that his 
intermediary described this release as the “mother load.” On Tuesday, October 4, 2016, Stone 
used @RogerJStoneJr to tweet: “Payload coming. #Lockthemup.” 

26. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

27. Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

28. WikiLeaks continued to release John Podesta’s hacked emails throughout October 
10-21, 2016. On October 12, 2016, John Podesta — referring back to Stone’s August 21, 2016 C- 
SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - or at 
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails] 
and the Trump campaign had advanced warning about what Assange was going to do. I think 
there’s at least a reasonable belief that [Assange] may have passed this information on to 
[Stone].” Commenting to the Miami Herald, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 


know is through that channel of communications. I’m not implying I have any influence with 
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him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 

29. On March 10, 2017, Stone spoke with The Washington Times and acknowledged 
he had been in contact with Guccifer 2.0 using @RogerJStoneJr. Stone publicly stated that he 
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter’s 
private message system to do so. Stone provided a copy of the private messages to The 
Washington Times. 

30. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

C. Roger Stone’s Private Twitter Direct Messages with WikiLeaks and Julian Assange. 

31. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. Contrary to Stone’s representation to CNN that he “never 
communicated with WikiLeaks,” Stone in fact communicated via private direct messaging with 
WikiLeaks during the Campaign. Stone also used the @RogerJStoneJr Twitter account’s private 
direct messaging system to communicate directly with Julian Assange since at least June 2017. 

SZ. For example, on October 13, 2016, while WikiLeaks was in the midst of releasing 


the hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
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@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

33. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

34. On October 16, 2016, @RogerJStoneJr sent a direct message to @wikileaks: “Ha! 
The more you \"correct\" me the more people think you're lying. Your operation leaks like a 
sieve. You need to figure out who your friends are.” 

39: On November 9, 2016, one day after the presidential election, @wikileaks sent a 
direct message to @RogerJStoneJr containing a single word: “Happy?” @wikileaks immediately 
followed up with another message less than a minute later: “We are now more free to 
communicate.” 

36. In addition, @RogerJStoneJr has also recently exchanged direct messages with 
Julian Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr 
directly messaged @JulianAssange, an address associated with Julian Assange in numerous 
public reports, stating: “Still nonsense. As a journalist it doesn't matter where you get 
information only that it is accurate and authentic. The New York Times printed the Pentagon 
Papers which were indisputably stolen from the government and the courts ruled it was legal to 
do so and refused to issue an order restraining the paper from publishing additional articles. If 


the US government moves on you I will bring down the entire house of cards. With the trumped- 


9 


Case 1:19-mc-00029-CRC Document 29-3 Filed 04/28/20 Page 15 of 25 


up sexual assault charges dropped I don't know of any crime you need to be pardoned for - best 
regards. R.” That same day, @JulianAssange responded: “Between CIA and DoJ they're doing 
quite a lot. On the DoJ side that's coming most strongly from those obsessed with taking down 

Trump trying to squeeze us into a deal.” 

37. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 


D. Roger Stone’s Emails Regarding WikiLeaks, Julian Assange, Russia, and John 
Podesta 


38. | On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 
issued a search warrant for STONE’s iJ address, iS (the 
Account”). Emails recovered pursuant to that search warrant indicated the following: 

39. On July 25, 2016, STONE sent an email from his J Account to JEROME 
CORSI, an author and political commentator, with the subject line, “Get to Assange.” The body 
of the message read: “Get to Assange [a]t Ecuadorian Embassy in London and get pending 
WikiLeaks emails...they deal with Foundation, allegedly.” 

40. Onor about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed the [J Account, “Word is 
friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to 
be very damaging . . .Time to let more than Podesta to be exposed as in bed w enemy if they are 
not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to 


start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much 
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of next dump focus, setting stage for Foundation debacle.” Based on my training, experience, 
and review of materials in this case, it appears that CORSI’s reference to a “friend in embassy 
[who] plans 2 more dumps” refers to Julian ASSANGE, the founder of WikiLeaks, who resided 
in Ecuador’s London Embassy in 2016. 

41. Onor about August 16, 2016, CORSI emailed the Target Account link to a piece 
CORSI had written about STONE titled, “Trump Adviser: WikiLeaks Plotting Email Dump to 
Derail Hillary.” 

42. On or about August 31, 2016, CORSI emailed the I Account: “Did you get 
the Podesta writeup.” STONE replied “yes.” 

43. On or about September 6, 2016, CORSI emailed the P| Account: “Roger|,] 
Is NY Post going to use the Pedesta [sic] stuff?” 

44, On or about October 4, 2016 STONE forwarded an email from his | o] 
Account to the Target Account with the subject line “Comment on WikiLeaks?” The email, 
from a reporter, asked STONE for any comment on the “lack of an ‘October surprise’ release 
from WikiLeaks today?” 

45. Onor about October 7, 2016, WikiLeaks began releasing the Podesta emails. 

46. Onor about October 12, 2016, the same day on which Podesta accused STONE of 
having advance knowledge of the publication of his emails, CORSI emailed STONE on both the 
Target Account and the {iJ Account, with a subject line “Podesta talking points.” Attached 
to the email was a file labeled, “ROGER STONE podesta talking points Oct 12 2016.docx.” The 
“talking points” included the statement that, “Podesta is at the heart of a Russian-government 
money laundering operation that benefits financially Podesta personally and the Clintons through 


the Clinton Foundation.” CORSI followed up several minutes later with another email to the 
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Target Account and the J Account titled, “Podesta talking points,” with the text “sent a 
second time just to be sure you go it.” STONE emailed CORSI back via the {J Account, 
“Got them and used them.” 

47. Onor about October 17, 2016, CORSI emailed the Target Account and the 
GE Account with the subject, “Fwd: ASSANGE...URGENT...” CORSI wrote, “From a 
very trusted source,” and forwarded an email with the header information stripped out, showing 
only the body text. The email read, “Yes[.] I figured this. Assange is threatening Kerry, Ecuador 
and U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a 
set of dead man files that include Hillary. It’s what they used to call a ‘Mexican stand off].]’ 
Only hope is that if Trump speaks out to save him[.] Otherwise he’d dead anyway, once he’s 
dropped what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange 
has to play out. He’s called Podesta’s bluff and raised him the election.” 

48.  Onor about January 7, 2017, iE emailed the Target Account, 


the J Account, CORSI, and i with the subject line, “in case you need 


his mail......... ” Attached to the message was a scan of a business card for John Podesta. 
Several hours later, J replied to all recipients, including the Target Account, “Ha... 
maybe he wants to go phishing with us?” 

49. — I know from my training and experience that the term “phishing” is used to refer 
to the practice of sending emails purporting to be from a reputable party in order to induce 
individuals to reveal personal information, including passwords. Public reports indicate that 
Podesta’s emails were obtaining through a “phishing” scheme. 


E. Roger Stone’s Use of the Target Account to Continue Conversations Begun on 
Twitter Direct Message. 
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50. | STONE has also used Target Account to continue conversations began via 
Twitter direct message. For example, on August 18, 2016, an individual sent @RogerJStoneJr a 
direct message asking “know where to send information to” regarding “Presidential polls and 
why cycle favors Trump.” Stone responded: “[Target Account].” 

51. On August 19, 2017, an individual sent a direct message to @RogerJStoneJr 
concerning an offer for “$500 for a 30 minute phone call,” stating that “My audience would be 
fascinated by discussion.” The individual then direct messages Stone, “Hi Roger! I'm striking 
out with your rep. Hoping we can swing something this week. My offer still stands.” 
@RogerJStoneJr wrote back: “Email me direct [Target Account].” 

BACKGROUND CONCERNING GOOGLE 

52. Google provides numerous free services to the users with a Google profile. Some 
of services include, Gmail, Google Talk, Google Wallet, Google+, Google Drive, Google+ 
Photos, and YouTube. Gmail is a web based email service. Google Talk is an instant messaging 
service that provides both text and voice communication. Google Talk conversation logs are 
saved to a “Chats” area in the user’s Gmail account. Google+ is a social networking service. 
Google Drive is a file storage and synchronization service which provides users with cloud 
storage, file sharing, and collaborative editing. Google+ Photos (formerly knowns as Picasa Web 
Albums) is an image hosting and sharing web service that allows users with a Google account to 
store and share images for free. YouTube is a free video sharing website that allows users 
upload, view, and share videos. Google also retains a record of searches conducted by the user, 
as well as location data for the use of some of the services described above. All of these services 


may record information uploaded, inputted, or gathered from the user. 
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53. In my training and experience, in addition to information such as search history 
can help to show the state of mind of an individual at the time the search was made, as well as 
the individuals potential advance knowledge of events, as they search to see if the anticipated 
event has occurred. Individuals who communicate via Gmail also often use other Google 
products, including Google Talk, to communicate, and Google Drive to store or transfer, open, or 
edit files. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

54. lL anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the account in Attachment A and 
particularly described in Section I of Attachment B. Upon receipt of the information described 
in Section I of Attachments B, government-authorized persons will review that information to 
locate the items described in Section II of Attachments B. The items identified in Attachments A 
and B will also be screened by reviewers not on the prosecution team to identify and filter out 
privileged material. 

CONCLUSION 

55. STONE instructed CORSI via the [J Account to “Get to Assange” at the 
Ecuadorian Embassy regarding upcoming leaks, and CORSI emailed Stone on the I 
Account that it was “Time to let more than Podesta to be exposed as in bed w enemy if they are 
not ready to drop HRC.” CORSI later emailed STONE “talking points” about Podesta to the 
Target Account, and also emailed the Target Account to convey information “from a very 


trusted source” regarding ASSANGE, WikiLeaks, and potential disclosure. STONE also used 
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the Target Account to continue conversations via email that he began on Twitter and forwarded 
emails related to WikiLeaks from the [J Account to the Target Account. There is 
therefore probable cause to believe that evidence of the DNC hack and the hacking of other 
emails associated with the 2016 election will be found in the information associated with the 
Target Account. 
56. Based on the forgoing, I request that the Court issue the proposed search warrant. 
57. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 


required for the service or execution of this warrant. 
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REQUEST FOR SEALING 


58. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


y Andprson 
Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this / day of October, 2017. 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the following Google account: 


that is stored at premises owned, maintained, controlled, or operated by Google, Inc., a business 


with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT B 
Particular Things to be Seized 


I. Files and Accounts to be produced by Google, Inc. between January 1, 2015 and 
the Present. 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment A: 


a. The contents of all e-mails, attachments and chat messages stored in the 
account, including copies of e-mails sent to and from the account, draft e-mails, the 
source and destination e-mails sent addresses associated with each e-mail, the date and 
time at which each e-mail was sent, and the size and length of each e-mail; 


b. All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 


ë. All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 


e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 


f. All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 


g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section I.A.; 


h. Google+ subscriber information, circle information, including name of 
circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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i. Google Drive files created, accessed or owned by the account; 


J YouTube subscriber information, private videos and files, private 
messages, and comments; 


k. Google+ Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 


|; Google Talk and Google Hangouts conversation logs associated with the 
account. 
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Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C.§ 1030 (fraud and 
related activities in connection with computers), 18 U.S.C. § 2 (aiding and abetting), and 18 
U.S.C. § 371 (conspiracy to commit an offense against the United States), for the period January 
2015 to the present, including: 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange; 


b. All images, messages, communications, calendar entries, search terms, 
and contacts, including any and all preparatory steps taken in furtherance of the above- 
listed offenses; 

A Communication, information, documentation and records relating to who 
created, used, or communicated with the account or identifier, including records about 
their identities and whereabouts; 


d. Evidence of the times the account was used; 


e. All images, messages and communications regarding wiping software, 
encryption or other methods to avoid detection by law enforcement; 


£ Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 


g. Credit card and other financial information, including but not limited to, 
bills and payment records evidencing ownership of the subject account; 


h. All existing printouts from original storage which concern the categories 
identified in subsection II.A; and 


i. All “address books” or other lists of contacts. 


20 


Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 1 of 31 


AO 106 (Rev. 04/10) Application for a Search Warrant E T i = B 


UNITED STATES DISTRICT COURT NOV -6 2017 


_ for the l Glerk, U.S. District & Bankruptcy 
District of Columbia Courts for the District of Columbia 


Case: 1:17-mj-00821 

Assigned To : Howell, Beryl A 

Assign. Date : 11/6/2017 
Description: Search and Seizure Warrant 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH THE TWITTER 
ACCOUNTS 


eee ee eS ee 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property to be searched and give its location): 


See Attachment A. 
located in the Northern District of California , there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment B. 


This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
M evidence of a crime; 
Wí contraband, fruits of crime, or other items illegally possessed; 
rf property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. § 1030 Fraud and Related Activities in Connection with Computers 
18 U.S.C. § 371, § 2 Conspiracy Against the United States, Aiding and Abetting 
50 U.S.C. § 30121 Foreign Contribution Ban 


The application is based on these facts: 


See attached Affidavit. 


Continued on the attached sheet. . 
O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


pplicant’s signature 


Reviewed by AUSA/SAUSA: 
Aaron Zelinsky (ASC) 


Amy Anderson, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


Date: 11/6/2017 Bag ale Ate Cf 
udge’s signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 


City and state; Washington, D.C. 
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FILED 


NOV -6 207 
IN THE UNITED STATES DISTRICT COURT m 
FOR THE DISTRICT OF COLUMBIA erk, U.S. District 
Courts for rp District a re uptey 
olumbia 


IN THE MATTER OF THE SEARCH OF Case: 1:17-mj-00821 
INFORMATION ASSOCIATED WITH THE Assigned To : Howell, Beryl A. 
TWITTER ACCOUNT (EES AND Assign. Date : 11/6/2017 
Description: Search and Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Amy Anderson, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

iF I make this affidavit in support of an application for a search warrant for 
information associated with the Twitter Accounts EM (hereafter “Target Account 1”) 
and B (hereafter “Target Account 2”), that is stored at premises owned, 
maintained, controlled, or operated by Twitter, a social-networking company headquartered in 
San Francisco, CA. The information to be disclosed by Twitter and searched by the Government 
is described in the following paragraphs and in Attachments A and B. This affidavit is made in 
support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 
2703(c)(1)(A). 

2; I am a Special Agent with Federal Bureau of Investigation (“FBI”) working 
directly with the Special Counsel’s Office. I have been a Special Agent with the FBI since 2010. 
Since then, I have conducted national security investigations of foreign intelligence services, 
espionage, and counter proliferation matters. I have training and experience related to espionage, 
foreign intelligence services, and national security investigations. I have conducted and 
participated in various investigations involving multiple threat countries as well as national 


security threats and applicable criminal violations. 
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sA The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4, Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that certain individuals with whom the Target Accounts were 
in communication have committed violations of 18 U.S.C. § 1030 (fraud and related activities in 
connection with computers), 50 U.S.C. § 30121 (foreign contribution ban), 18 U.S.C. § 2 (aiding 
and abetting), 18 U.S.C. § 371 (conspiracy to commit an offense against the United States), and 
that communications related to these violations will be found on the Target Accounts. There is 
therefore probable cause to search the information described in Attachment A for evidence of 
these crimes and contraband or fruits of these crimes, as described in Attachment B. 

5. As detailed further below, from on or about June 22, 2016, through at least on or 
about July 17, 2016, Target Account 1, belonging to WikiLeaks, exchanged numerous direct 
messages concerning hacked information with Guccifer 2.0, which was a Twitter account used 
by the Russian Government to release data obtained through hacking accounts of U.S. users. 
Target Account 1 also sent direct messages via Twitter concerning a “guessed” password for the 
website “(I co “Target Account 2 belongs to Julian Assange, 
the founder of WikiLeaks. Beginning no later than on or about July 2016, former Campaign 
adviser Roger Stone was in contact with Assange via an intermediary regarding upcoming leaks 
of hacked information obtained by WikiLeaks. In addition, Assange, using Target Account 2, 
communicated directly with Stone beginning no later than on or about April 7, 2017. Stone 


stated to Target Account 2 that he was “doing everything possible to address the issues [related 
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to WikiLeaks] at the highest level of Government,” and that he and Target Account 2 “must be 
circumspect in this forum as experience demonstrates it is monitored.” 
JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Jd. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below 
in paragraph 9. 
PROBABLE CAUSE 
A. Background on the Target Accounts, Julian Assange, and Roger Stone. 

T; Target Account 1 is the public account of WikiLeaks. As detailed further below, 
it frequently has been used to release hacked information, including during the 2016 election. 
Target Account 2 is the public account of Julian Assange. Target Account 2 has over 500,000 
followers, but only follows one account, Target Account 1. Target Account 2 frequently 
tweets information related to WikiLeaks and tags Target Account 1. 

8. Julian Assange is the founder of WikiLeaks. According to the publicly-accessible 
profile of Target Account 2, Assange currently is the “Publisher @WikiLeaks [Target Account 
1].” Target Account 2’s profile contains a link to the website “IlamWikiLeaks.org\donate.” 
According to publicly-available press reporting, Assange began hacking secure computer 
systems when he sixteen years old, in 1987. On or about December 1996, Assange pled guilty in 
Australia to twenty-five charges related to hacking secure computer systems. In 2006, Assange 


and others established WikiLeaks, and he previously described himself as WikiLeaks’s Editor- 
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in-Chief. Assange has stated in public interviews that he is deeply involved in running 
WikiLeaks. Referring to the DNC emails, Assange stated in an August, 2017 interview that, “We 
had quite some difficulties to overcome, in terms of the technical aspects, and making sure we 
were comfortable with the forensics,” and that “You have to get close and interact with it, then 
you start to get a feel.” Assange indicated that only a small number of people, including himself, 
worked on the release of the DNC emails. Assange stated in August 2016 to a news organization 
that, “We are working around the clock. We have received quite a lot of material.” 

9. Roger Stone is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics since 1975. Stone officially worked on the presidential 
campaign of Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no 
official relationship with the Campaign thereafter, Stone maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. After 
Stone’s public departure from the Campaign, Stone continued to correspond with individuals 
related to the Campaign, including Paul Manafort (who worked for a time as Campaign 
manager), Rick Gates (a campaign adviser), and Jason Miller (Campaign spokesman). As 
discussed farther below, Stone made a number of public references to WikiLeaks, Julian 
Assange, and the release of DNC-related emails. 


B. The DNC Email Hack and Russia’s Use of “Guccifer 2.0” and WikiLeaks to 
Disseminate Hacked Information. 


10. According to the public and unclassified intelligence report prepared by the 
United States Intelligence Community, Russian intelligence gained access to the Democratic 
National Committee (DNC) networks in July 2015 and maintained that access until at least June 


2016. By March 2016, the Russian military intelligence (General Staff Main Intelligence 
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Directorate or “GRU”) probably began cyber operations aimed at the U.S. election. The GRU 
operations resulted in the compromise of personal e-mail accounts within the DNC and other 
Democratic Party officials and political figures. By in or about May 2016, the GRU had 
exfiltrated large volumes of data from the DNC. The DNC headquarters is located at 430 South 
Capitol Street SE, Washington, D.C. 20003. 

11. The public and unclassified intelligence report assessed that: 

a. The GRU used a Twitter account, “Guccifer 2.0” and the website 
DCLeaks.com to release the U.S. victim data obtained in cyber operations publicly and in 
exclusives to media outlets and relayed material to WikiLeaks. 

b. Guccifer 2.0, who claimed to be an independent Romanian hacker, made 
multiple contradictory statements and false claims about his likely Russian identity 
throughout the election. 

c Content that was taken from e-mail accounts targeted by the GRU in 
March 2016 appeared on DCLeaks.com starting in June 2016. 

d. The GRU relayed material it acquired from the DNC and senior 
Democratic officials to WikiLeaks. WikiLeaks was mostly likely chosen because of its 
self-proclaimed reputation for authenticity. Disclosures through WikiLeaks did not 
contain any evident forgeries. 

ç; The Kremlin’s principal international propaganda outlet RT (formerly 
Russia Today) has actively collaborated with WikiLeaks. RT’s editor-in-chief visited 
WikiLeaks founder Julian Assange at the Ecuadorian Embassy in London in August 
2013, where they discussed renewing his broadcast contract with RT, according to 


Russian and Western media. Russian media has subsequently announced that RT had 
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become “the only Russian media company” to partner with WikiLeaks and had received 

access to “new leaks of secret information.” 

f. On or about August 6, 2016, RT published an English-language video 
called “Julian Assange Special: Do WikiLeaks Have the E-Mail That’Il Put Clinton in 
Prison?” and an exclusive interview with Assange entitled “Clinton and ISIS Funded by 
the Same Money.” 

12. On or about June 14, 2016, the Washington Post reported that “Russian 
government hackers” had penetrated the DNC computer network and stole opposition research 
on Donald J. Trump. The Kremlin’s spokesman denied any Russian involvement in the hack. 

13. On or about June 15, 2016, Guccifer 2.0 claimed responsibility for the DNC hack 
and began posting hacked documents. 

14. As detailed further below, on or about June 22, 2016, Guccifer 2.0 and Target 
Account 1 initiated communication via Twitter private messaging regarding the transfer and 
release of hacked information, including the hacked email accounts related to the DNC. 

15, On or about July 22, 2016, WikiLeaks published about 20,000 emails stolen from 
the DNC. Using Target Account 1, WikiLeaks publicly tweeted: “WikiLeaks releases thousands 
of documents about Clinton and internal deliberations” and linked to a Washington Post article 
and www.wikileaks.org/dne-emails/. 

16. On or about August 12, 2016, Guccifer 2.0 released personal cellphone numbers 
and email addresses from the files of the Democratic Congressional Campaign Committee 
(DCCC). 

17. On or about August 21, 2016, Roger Stone directed a publicly-available tweet at 


John Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon 
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the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same day, 
Stone reiterated that because of the work of a “‘mutual acquaintance’ of both his and [Assange], 
the public [could] expect to see much more from the exiled whistleblower in the form of 
strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Chery] Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

18. On or about September 13, 2016, Target Account 1 tweeted a public message 
stating, “678.4 MB of new ‘DNC documents’ from @Guccifer_2,” with a link to a publicly 
available file. 

19. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

20. Approximately a half hour later, at 4:32 P.M., Target Account 1 sent out a Tweet 
reading “RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing 
a link to approximately 2,050 emails that had been hacked from John Podesta’s personal email 
account. WikiLeaks, via Target Account 1, continued to release John Podesta’s hacked emails 


throughout October 10-14, 2016. 


C. Communications Between the Target Account 1 and Guccifer 2.0 


21. On July 7, 2017 Magistrate Judge Maria-Elena James of the Northern District of 
California issued a search warrant for the Twitter Account associated with Guccifer 2.0. The 


communications obtained from the account are detailed further below. 


Case 1:19-mc-00029-CRC Document 29-4 Filed 04/28/20 Page 9 of 31 


22; On or about June 22, 2016, WikiLeaks sent Guccifer 2.0 sent a direct message 
(DM) stating “Do you have secure communications?” Target Account 1 stated, “Send any new 
material here for us to review and it will have a much higher impact than what you are doing. No 
other media will release the full material.” Guccifer 2.0 replied, “what can u suggest for a secure 
connection? Soft, keys, etc? I’m ready to cooperate with you, but I need to know what’s in your 
archive 80gb? Are there only HRC emails? Or some other docs? Are there any DNC docs? If it’s 
not secret when you are going to release it?” Target Account 1 wrote back, “You can send us a 
message in a .txt file here,” and attached a web link. Guccifer 2.0 responded, “do you have 
GPG?” I know from my training and experience that “GPG” refers to a program for exchanged 
encrypted information. 

23. On or about June 24, 2016, Guccifer 2.0 wrote to Target Account 1, “How can 
we chat? Do u have jabber or something like that?” I know from my training and experience that 
“Jabber” is an instant messaging service. Target Account 1 wrote back, “Yes, we have 
everything. We’ve been busy celebrating Brexit. You can also email an encrypted message to 
office@wikileaks.org. They key is here.”' A web link was attached to the message. I know from 
my training and experience that an encryption “key” is a string of information created for 
scrambling and unscrambling data. 

24. On or about June 27, 2016, Guccifer 2.0 wrote to Target Account 1, “Hi, [I]’ve 
just sent you an email with a text message encrypted and an open key.” Target Account 1 wrote 


back, “Thanks.” Guccifer 2.0 replied, “waiting for ur response. I send u some interesting piece.” 


'Target Account 1 sent each sentence as a separate message, though close in time. These messages have been 
consolidated into a single quote for ease of reading. The same is done below with other close in time messages. 
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25. On or about July 4, 2016, Guccifer 2.0 wrote to Target Account 1, “hi there, 
check up r email, waiting for [rJeply.” 

26. On or about July 6, 2016, Guccifer 2.0 wrote to Target Account 1, “have u 
received my parcel?” Target Account 1 responded, “Not unless it was very recent. [we haven’t 
checked in 24h].”? Guccifer 2.0 replied, “I sent it yesterday, an archive of about 1 gb. via 
[website link]. [A]nd check your email.” Target Account 1 wrote back, “Wil[1] check, thanks.” 
Guccifer 2.0 responded, “let me know the results.” Target Account 1 wrote back, “Please don’t 
make anything you send to us public. It’s a lot of work to go through it and the impact is severely 
reduced if we are not the first to publish.” Guccifer 2.0 replied, “agreed. How much time will it 
take?” Target Account 1 responded, “likely sometime today.” Guccifer 2.0 wrote back, “will u 
announce a publication? and what about 3 docs [I] sent u earlier?” Target Account 1 responded, 
“I don’t believe we received them. Nothing on ‘Brexit’ for example.” Guccifer 2.0 wrote back, 
“wow. have you checked ur mail?” Target Account 1 replied, “At least not as of 4 days ago. ... 
For security reasons mail cannot be checked for some hours.” Guccifer 2.0 wrote back, “fuck, [I] 
sent 4 docs on brexit on jun 29, an archive in gpg[.] ur submission form is too fucking slow, [I] 
spent the whole day uploading 1 gb.” I know from my training and experience that the term “gb” 
is an abbreviation for “gigabyte,” a unit of measurement of information stored on a computer. 

27. Target Account 1 wrote back, “We can arrange servers 100x as fast. The speed 
restrictions are to anonymise the path. Just ask for custom fast upload point in an email.” 
Guccifer 2.0 wrote, “will u be able to check ur email?” Target Account 1 responded, “We’re 


best with very large data sets. e.g. 200gb. these prove themselves since they’ re too big to fake.” 


? The brackets appear in the original message. 
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Guccifer 2.0 responded, “or shall I send brexit docs via submission once again?” Target 
Account 1 responded, “to be safe, send via [web link].” 

28. On or about that same day, Guccifer 2.0 wrote, “can u confirm u received dne 
emails?” Target Account 1 wrote back several messages later, “for security reasons we can’t 
confirm what we’ve received here. e.g., in case your account has been taken over by us 
intelligence and is probing to see what we have.” Guccifer 2.0 responded, “then send me an 
encrypted email.” Target Account 1 wrote back, “we can do that. but the security people are in 
another time zone so it will need to wait some hours.” Target Account 1 wrote, “what do you 
think about the FBI’s failure to charge? To our mind the clinton foundation investigation has 
always been the more serious. we would be very interested in all the emails/docs from there. She 
set up quite a lot of front companies. e.g in sweden.” Guccifer 2.0 responded, “ok, [I]’ll be 
waiting for confirmation. [A]s for investigation, they have everything settled, or else I don’t 
know how to explain that they found a hundred classified docs but fail to charge her.” Target 
Account 1 responded, “She’s too powerful to charge at least without something stronger. [A]s 
far as we know, the investigation into the clinton foundation remains open[.] [W]e hear the FBI 
are unhappy with Loretta Lynch over meeting Bill, because he’s a target in that investigation.” 

29. On or about that same day, Guccifer 2.0 wrote to Target Account 1, “[D]o you 
have any info about marcel lazar? There’ve been a lot of rumors of late.” “Marcel Lazar” is the 
name of a Romanian Hacker who used the pseudonym “Guccifer,” and who pled guilty on May 
25, 2016 in the Eastern District of Virginia to hacking the personal accounts of a variety of 
victims, including a former U.S. president. According to publicly available reporting, in May 
2016, Lazar also claimed to have hacked the email served belonging to then-candidate Clinton. 


Lazar stated, “For me, it was easy . . . easy for me, for everybody.” Lazar’s claims have not been 
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substantiated, and the undersigned is not aware of evidence indicating Lazar accomplished the 
hack. 

30. Target Account 1 wrote back, “the death? [A] fake story.” Target Account 1 
messaged: “His 2013 screen shots of Max Blumenthal’s inbox prove that Hillary secretly deleted 
at least one email about Libya that was meant to be handed over to Congress. So we were very 
interested in his co-operation with the FBI.” Guccifer 2.0 wrote back, “some dirty games behind 
the scenes [I] believe[.] Can you send me an email now?” Target Account 1 wrote back, “No; 
we have not been able to activate the people who handle it. Still iing” Guccifer 2.0 replied, 
“what about tor submission? [W]ill u receive a doc now?” Target Account 1 replied, “We will 
get everything sent on [weblink].” [A]s long as you see upload succseful\” at the end. [I]f you 
have anything hillary related we want it in the next tweo [sic] days prefable [sic] because the 
DNC is approaching and she will solidify bernie supporters behind her after.” Guccifer 2.0 
responded, “ok. I see.” 

31. Target Account 1 wrote, “[W]e think the public interest is greatest now and in 
early october.” —_— 2.0 responded, “do u think a lot of people will attend bernie fans rally in 
philly? Will it affect the dnc anyhow?” Target Account 1 wrote, “bernie is trying to make his 
own faction leading up to the DNC. [S]o he can push for concessions (positions/policies) or, at 
the outside, if hillary has a stroke, is arrested etc, he can take over the nomination. [T]he question 
is this: can bernies supporters+staff keep their coherency until then (and after). [O]r will they 
dis[s]olve into hillary’s camp? [P]resently many of them are looking to damage hilary [sic] 
inorder [sic] to increase their unity and bargaining power at the DNC. Doubt one rally is going to 
be that significant in the bigger scheme. [I]t seems many of them will vote for hillary just to 


prevent trump from winning.” 
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32. On or about that same day, Guccifer 2.0 sent Target Account 1 a message 
reading, “sent brexit docs successfully.” Target Account 1 responded, “:))).” Target Account 1 
wrote back, “we think trump has only about a 25% chance of winning against hillary so conflict 
between bernie and hillary is interesting.” Guccifer 2.0 responded, “so it is.” Target Account 1 
wrote, “also, it’s important to consider what type of president hillary might be. If bernie and 
trump retain their groups past 2016 in significant number, then they are a restraining force on 
hillary.” 

33. Onor about July 7, 2016, Target Account 1 wrote, “All good?” Guccifer 2.0 
responded, “yeah, what about u? is smth wrong?” I know from my training and experience that 
“smth” is used as an abbreviation for “something.” Target Account 1 wrote back, “No. All 
good.” Guccifer 2.0 wrote back, “are working with the emails [I] sent u? [C]heck ur email. [I] 
sent u a check archive from another email box. fuck, mail undelivered. [D]o you have another 
way to receive large volumes of data? [B]esides for tor submission form?” 

34. Onor about July 11, 2016, Guccifer 2.0 wrote to Target Account 1, “sent it via 
ur submission. check it.” 

35. On or about July 13, 2016, Guccifer 2.0 wrote, “r u there?” On or about July 14, 
2016, Guccifer 2.0 wrote, “ping. Check ur email. sent u a link to a big archive and a pass.” 
Target Account 1 replied, “great, thanks; can’t check until tomorrow though.” 

36. On or about July 17, 2016, Guccifer 2.0 wrote, “what bout now?” On or about 
July 18, 2016, Target Account 1 responded, “have the 1Gb or so archive.” Guccifer 2.0 
responded, “have u managed to extract the files?” Target Account 1 responded, “yes. turkey 
coup has delayed us a couple of days. [O]therwise all ready[.]” Guccifer 2.0 responded, “so 


when r u about to make a release?” Target Account 1 wrote back, “this week. [D]o you have 
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any bigger datasets? [D]id you get our fast transfer details?” Guccifer 2.0 wrote back, “i’Il check 
it. did u send it via email? Target Account 1 responded, “yes.” Guccifer 2.0 replied, “to [web 
link]. [I] got nothing.” Target Account 1 wrote, “check your other mail? this was over a week 
ago.” Guccifer 2.0 wrote back, “oh, that one, yeah, [I] got it.” 

37. | Onor about July 18, 2016, Target Account 1 wrote, “great. [D]id it work?” 
Guccifer 2.0 wrote back, “[I] haven’t tried yet.” Target Account 1 responded, “Oh. We arranged 
that server just for that purpose. Nothing bigger?” Guccifer 2.0 wrote back, “let’s move step by 
step, u have released nothing of what [I] sent u yet.” Target Account 1 replied, “How about you 
transfer it all to us encrypted. [T]hen when you are happy, you give us the decrypt key. [T]his 
way we can move much faster. [A]lso it is protective for you if we already have everything 
because then there is no point in trying to shut you up.” Guccifer 2.0 wrote back, “ok, ill ponder 
i 

D. Contacts Involving the Julian Assange, Roger Stone, and the Target Accounts 

38. Approximately eight days after the last communication between Guccifer 2.0 and 
WikiLeaks described above, on or about July 25, 2016, Stone sent an email to Jerome Corsi, an 
author and political commentator, with the subject line, “Get to Assange.”? The body of the 
message read: “Get to Assange [a]t Ecuadorian Embassy in London and get the pending 
wikileaks emails...they deal with Foundation, allegedly.” 

39. On or about August 2, 2016, Corsi emailed Stone, “Word is friend in embassy 
plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging 
i On August 7, 2017, Chief Judge Beryl A. Howell of the District of Columbia issued a search warrant for 
Roger Stone’s Twitter account, @RogerJStoneJr. On September 11, 2017, Chief Judge Beryl A. Howell of the 


District of Columbia issued a search warrant for Stone’s Hotmail address, i The relvant 
results of those search warrants are summarized in the paragraphs which follow. 
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. . -Time to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop 
HRC. That appears to be the game hackers are now about. Would not hurt to start suggesting 
HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of next dump 
focus, setting stage for Foundation debacle.” Based on my training, experience, and review of 
materials in this case, it appears that Corsi’s reference to a “friend in embassy [who] plans 2 
more dumps” refers to Julian Assange (the user of Target Account 2), the founder of 
WikiLeaks, who resided in Ecuador’s London Embassy in 2016. 
40. On or about August 16, 2016, Corsi emailed Stone a link to a piece Corsi had 
written about Stone titled, “Trump Adviser: Wikileaks Plotting Email Dump to Derail Hillary.” 
41. As discussed above, on or about August 21, 2016, Roger Stone directed a 
publicly-available tweet at John Podesta, Hillary Clinton’s presidential campaign manager, 
stating: “Trust me, it will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” 

42. On or about August 31, 2016, Corsi emailed Stone: “Did you get the PODESTA 
write-up.” STONE replied “Yes.” 

43. | On or about September 6, 2016, Corsi emailed: “Roger[,] Is NY Post going to use 
the Pedesta [sic] stuff?” 

44. On or about October 7, 2016, WikiLeaks began releasing emails hacked from 
John Podesta’s account. 

45. WikiLeaks continued to release John Podesta’s hacked emails throughout October 
10-21, 2016. On October 12, 2016, John Podesta argued publicly that “[it is] a reasonable 
assumption to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the 
release of his emails] and the Trump campaign had advanced warning about what Assange was 


going to do. I think there’s at least a reasonable belief that [Assange] may have passed this 
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information on to [Stone].” Commenting to the Miami Herald on or about that same date, Stone 
responded: “I have never met or spoken with Assange, we have a mutual friend who’s traveled to 
London several times, and everything I know is through that channel of communications. I’m not 
implying I have any influence with him or that I have advanced knowledge of the specifics of 
what he is going to do. I do believe he has all of the e-mails that Huma Abedin and Chery! Mills, 
the Clinton aides, thought were deleted. I hear that through my emissary.” 

46. On or about that same day, October 12, 2016, Corsi emailed Stone on both the 
with a subject line “Podesta talking points.” Attached to the email was a file labeled, “ROGER 
STONE podesta talking points Oct 12 2016.docx.” The “talking points” included the statement 
that, “Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” Corsi followed 
up several minutes later with another email titled, “Podesta talking points,” with the text “sent a 
second time just to be sure you go it.” Stone emailed Corsi back, “Got them and used them.” 

47. On or about the next day, October 13, 2016, Stone sent a private direct message to 
Target Account 1 stating, “Since I was all over national TV, cable and print defending 
wikileaks and assange against the claim that you are Russian agents and debunking the false 
charges of sexual assault as trumped up bs you may want to rexamine the strategy of attacking 
me- cordially R.” Target Account 1 responded, “We appreciate that. However, the false claims 
of association are being used by the democrats to undermine the impact of our publications. 
Don't go there if you don't want us to correct you.” 

48. On or about October 16, 2016, Roger Stone wrote to Target Account 1, “Ha! The 
more you \"correct\" me the more people think you're lying. Your operation leaks like a sieve. 


You need to figure out who your friends are.” 
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49. On or about October 17, 2016, Corsi emailed Stone with the subject, “Fwd: 
ASSANGE...URGENT...” Corsi wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is he has a set of dead man files that include Hillary. It’s 
what they used to call a ‘Mexican stand off].]’ Only hope is if Trump speaks out to save him[.] 
Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can kiss his 
life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and raised him 
the election.” 

50. The presidential election was held on November 8, 2016. 

51. On or about November 9, 2016, Target Account 1 messaged Roger Stone, 
“Happy?” and then wrote, “We are now more free to communicate.” 

52. On or about March 27, 2017, Target Account 1 wrote to Roger Stone, “FYI, 
while we continue to be unhappy about false \"back channel\" claims, today CNN deliberately 
broke our off the record comments.” 

53. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 


limited things I did predict (Oct disclosures) all came true.” 
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54. On or about April 7, 2017, Roger Stone wrote to Target Account 1, “I am JA’s 
only hope for a pardon the chances of which are actually (weirdly) enhanced by the bombing in 
Syria (which I opposed) . You have no idea how much your operation leaks. Discrediting me 
only hurts you. Why not consider saying nothing? PS- Why would anyone listen to that asshole 
Daniel Ellsberg.” Based on my training, experience, and review of materials in this case, | 
believe that “JA” refers to Julian Assange, the user of Target Account 2. 

35; On or about April 19, 2017, Assange, using Target Account 2, wrote to Stone, 
“Ace article in infowars. Appreciated. But note that U.S. intel is engages in slight of hand 
maoevers [sic]. Listen closely and you see they only claim that we received U.S. election leaks 
\"not directly\" or via a \"third party\" and do not know \"when\" etc. This line is Pompeo appears 
to be getting at with his \"abbeted\". This correspnds to the same as all media and they do not 
make any allegation that WL or I am a Russia asset.” 

56. On or about June 4, 2017, Roger Stone wrote back to Target Account 2, “Still 
nonsense. As a journalist it doesn't matter where you get information only that it is accurate and 
authentic. The New York Times printed the Pentagon Papers which were indisputably stolen 
from the government and the courts ruled it was legal to do so and refused to issue an order 
restraining the paper from publishing additional articles. If the US government moves on you I 
will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I 
don't know of any crime you need to be pardoned for - best regards. R.” Target Account 2 
responded, “Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most 
strongly from those obsessed with taking down Trump trying to squeeze us into a deal.” 

57. Onor about June 10, 2017, Roger Stone wrote to Target Account 2, “I am doing 


everything possible to address the issues at the highest level of Government. Fed treatment of 
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you and Wikileaks is an outrage. Must be circumspect in this forum as experience demonstrates 
it is monitored. Best regards R.” Target Account 2 wrote back, “Appreciated. Of course it is!” 


E. Target Account 1 Sends the “Guessed” Password to ‘ ” to 


58. During the events described above, Target Account 1 also engaged in a separate 
proviate conversation regarding a “guessed” password to the non-public website 
“PutinTrump.org.” On or about September 20, 2016, at approximately 9:07PM, Target Account 
1 publicly tweeted, ““Let’s bomb Iraq’ Progress for America PAC to launch ‘PutinTrump.org’ at 
9:30am. Oops pw is {I putintrump.org.” 

59. | On or about September 20, 2016, at approximately 11:59PM, Target Account 1 
sent a private message to a high level individual associated with the Campaign (the “high-level 
Campaign individual”).* The message stated: “A PAC run anti-Trump site QD is 
about to launch. The PAC is a recycled pro-Iraq war PAC. We have guessed the password. It is 
GD . See ‘About’ for who is behind it. Any comments?” 

60. According to publicly available reporting, at approximately 9:31AM on or about 
September 21, 2016, the website ‘(was launched. The website was run by 
individuals who stated they wanted to focus attention to what they described as the “dangerous 
and unprecedented ties” between Vladimir Putin and Donald J. Trump. 

61. On or about September 21, 2016, at approximately 11:50AM (approximately two 


hours after PutinTrump.org went “live” according to publicly available press accounts), the high- 


4 These records were obtained via a search warrant signed by Chief Judge Beryl A. Howell of the District of 
Columbia on October 12, 2017. 
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level Campaign individual sent Target Account 1 a private message: “Off the record I don’t 
know who that is but I’ll ask around. Thanks.” 
INFORMATION CONCERNING TWITTER 

62. Twitter owns and operates a free-access social-networking website of the same 
name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own 
profile pages, which can include a short biography, a photo of themselves, and location 
information. Twitter also permits users to create and read 140-character messages called 
“Tweets,” and to restrict their “Tweets” to individuals whom they approve. These features are 
described in more detail below. 

63. | Upon creating a Twitter account, a Twitter user must create a unique Twitter 
username and an account password, and the user may also select a different name of 20 
characters or fewer to identify his or her Twitter account. The Twitter user may also change this 
username, password, and name without having to open a new Twitter account. 

64. Twitter asks users to provide basic identity and contact information, either during 
the registration process or thereafter. This information may include the user’s full name, e-mail 
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown, 
occupation, and other personal identifiers. For each user, Twitter may retain information about 
the date and time at which the user’s profile was created, the date and time at which the account 
was created, and the Internet Protocol (“IP”) address at the time of sign-up. Because every 
device that connects to the Internet must use an IP address, IP address information can help to 
identify which computers or other devices were used to access a given Twitter account. 

65. A Twitter user can post a personal photograph or image (also known as an 


“avatar”) to his or her profile, and can also change the profile background or theme for his or her 
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account page. In addition, Twitter users can post “bios” of 160 characters or fewer to their profile 
pages. 

66. Twitter also keeps IP logs for each user. These logs contain information about the 
user’s logins to Twitter including, for each access, the IP address assigned to the user and the 
date stamp at the time the user accessed his or her profile. 

67. As discussed above, Twitter users can use their Twitter accounts to post “Tweets” 
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was 
posted to Twitter. Twitter users can also “favorite,” “retweet,” or reply to the Tweets of other 
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign, 
Twitter designates that Tweet a “mention” of the identified user. In the “Connect” tab for each 
account, Twitter provides the user with a list of other users who have “favorited” or “retweeted” 
the user’s own Tweets, as well as a list of all Tweets that include the user’s username (i.e., a list 
of all “mentions” and “replies” for that username). 

68. Twitter users can include photographs or images in their Tweets. Each Twitter 
account also is provided a user gallery that includes images that the user has shared on Twitter, 
including images uploaded by other services. 

69. Twitter users can also opt to include location data in their Tweets, which will 
reveal the users’ locations at the time they post each Tweet. This “Tweet With Location” 
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users 
may delete their past location data. 

70. | When Twitter users want to post a Tweet that includes a link to a website, they 
can use Twitter’s link service, which converts the longer website link into a shortened link that 


begins with http://t.co. This link service measures how many times a link has been clicked. 
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Fs A Twitter user can “follow” other Twitter users, which means subscribing to 
those users’ Tweets and site updates. Each user profile page includes a list of the people who are 
following that user (i.e., the user’s “followers” list) and a list of people whom that user follows 
(i.e., the user’s “following” list). Twitters users can “unfollow” users whom they previously 
followed, and they can also adjust the privacy settings for their profile so that their Tweets are 
visible only to the people whom they approve, rather than to the public (which is the default 
setting). A Twitter user can also group other Twitter users into “lists” that display on the right 
side of the user’s home page on Twitter. Twitter also provides users with a list of “Who to 
Follow,” which includes a few recommendations of Twitter accounts that the user may find 
interesting, based on the types of accounts that the user is already following and who those 
people follow. 

72. In addition to posting Tweets, a Twitter user can also send DMs to one of his or 
her followers. These messages are typically visible only to the sender and the recipient, and both 
the sender and the recipient have the power to delete the message from the inboxes of both users. 
As of January 2012, Twitter displayed only the last 100 DMs for a particular user, but older DMs 
are stored on Twitter’s database. 

73. Twitter users can configure the settings for their Twitter accounts in numerous 
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the 
user’s mobile phone, and the user can also set up a “sleep time” during which Twitter updates 
will not be sent to the user’s phone. 

74. Twitter includes a search function that enables its users to search all public 
Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to 


25 past searches. 
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75. Twitter users can connect their Twitter accounts to third-party websites and 
applications, which may grant these websites and applications access to the users’ public Twitter 
profiles. 

76. If a Twitter user does not want to interact with another user on Twitter, the first 
user can “block” the second user from following his or her account. 

77. In some cases, Twitter users may communicate directly with Twitter about issues 
relating to their account, such as technical problems or complaints. Social-networking providers 
like Twitter typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. Twitter may also suspend a particular user 
for breaching Twitter’s terms of service, during which time the Twitter user will be prevented 
from using Twitter’s services. 

78. As explained herein, information stored in connection with a Twitter account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Twitter user’s account information, IP log, stored electronic communications, and other data 
retained by Twitter, can indicate who has used or controlled the Twitter account. This “user 
attribution” evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence. For example, profile contact information, communications, 
“tweets” (status updates) and “tweeted” photos (and the data associated with the foregoing, such 
as date and time) may be evidence of who used or controlled the Twitter account at a relevant 


time. Further, Twitter account activity can show how and when the account was accessed or 
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used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from 
which users access their accounts along with the time and date. By determining the physical 
location associated with the logged IP addresses, investigators can understand the chronological 
and geographic context of the account access and use relating to the crime under investigation. 
Such information allows investigators to understand the geographic and chronological context of 
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter 
builds geo-location into some of its services. If enabled by the user, physical location is 
automatically added to “tweeted” communications. This geographic and timeline information 
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account 
activity may provide relevant insight into the Twitter account owner’s state of mind as it relates 
to the offense under investigation. For example, information on the Twitter account may 
indicate the owner’s motive and intent to commit a crime (e.g., information indicating a criminal 
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal 
evidence from law enforcement). 

79. Therefore, the computers of Twitter are likely to contain all the material described 
above, including stored electronic communications and information concerning subscribers and 
their use of Twitter, such as account access information, transaction information, and other 
account information. 

INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

80. - I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Twitter to disclose to the government copies of the records and other information 


(including the content of communications) associated with the accounts in Attachment A and 
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particularly described in Section I of Attachment B. Upon receipt of the information described in 
Section I of Attachment B, government-authorized persons will review that information to locate 
the items described in Section II of Attachment B. 
CONCLUSION 

81. Based on the forgoing, I request that the Court issue the proposed search warrant. 

82. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

83. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 


documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Amy Anderson 
Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this Zz day of November, 2017. 


Z fae? 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to Be Searched 
All information that is associated with the Twitter profile with usernames from the period 
from July 1, 2015 to the present: 
@Wikileaks (twitter.com/wikileaks) (Target Account 1) 
@JulianAssange (twitter.com/JulianAssange) (Target Account 2) 
that is stored at premises owned, maintained, controlled, or operated by Twitter, a company 


headquartered in San Francisco, California. 
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ATTACHMENT B 


Particular Things to be Seized 


L Information to be disclosed by Twitter 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Twitter, including any messages, records, files, logs, or information that 


have been deleted but are still available to Twitter, or have been preserved pursuant to a request 


made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following information to the 


government for each account listed in Attachment A: 


a. 


All identity and contact information, including full name, e-mail address, physical 
address (including city, state, and zip code), date of birth, gender, hometown, 
occupation, and other personal identifiers; 

All past and current usernames, account passwords, and names associated with 
the account; 

The dates and times at which the account and profile were created, and the 
Internet Protocol (“IP”) address at the time of sign-up; 

All IP logs and other documents showing the IP address, date, and time of each 
login to the account; 

All data and information associated with the profile page, including photographs, 
“bios,” and profile backgrounds and themes; 

All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the 
account, and all photographs or images included in those Tweets and Direct 


Messages; 
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g. All information from the “Connect” tab for the account, including all lists of 
Twitter users who have favorited or retweeted Tweets posted by the account, as 
well as a list of all Tweets that include the username associated with the account 
(i.e., “mentions” or “replies”); 

h. All photographs and images in the user gallery for the account; 

i. All location data associated with the account, including all information collected 
by the “Tweet With Location” service; 

ifi All information about the account’s use of Twitter’s link service, including all 
longer website links that were shortened by the service, all resulting shortened 
links, and all information about the number of times that a link posted by the 
account was clicked; 

k. All data and information that has been deleted by the user; 

I. A list of all of the people that the user follows on Twitter and all people who are 


following the user (i.e., the user’s “following” list and “followers” list); 


m. A list of all users that the account has “unfollowed” or blocked; 

n. All “lists” created by the account; 

o. All information on the “Who to Follow” list for the account; 

p. All privacy and account settings; 

q. All records of Twitter searches performed by the account, including all past 


searches saved by the account; 
r. All information about connections between the account and third-party websites 


and applications; 
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S. All records pertaining to communications between Twitter and any person 
regarding the user or the user’s Twitter account, including contacts with support 


services, and all records of actions taken, including suspensions of the account. 
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II. Information to be seized by the government 

All information described above in Section I that constitutes fruits, evidence, and 
instrumentalities of violations of 18 U.S.C. § 1030 (fraud and related activities in connection 
with computers), 50 U.S.C. § 30121 (foreign contribution ban), 18 U.S.C. § 371 (conspiracy to 
commit an offense against the United States), and 18 U.S.C. § 2 (aiding and abetting) since 
March 1, 2016 including, for each user ID identified on Attachment A, information pertaining to 
the following matters: 

a. Any correspondence regarding hacked emails or other data from: 

i. the Democratic National Committee (DNC) 
ii. the email belonging to John Podesta (“the email hack”) 
iii. any other individual related to the 2016 United States election. 

b. Any communications between the Target Accounts and individuals 
associated with the DNC email hack; 

c. Any communications indicating any advance knowledge or direction, 
planning, or control of the email hack; 

d. Any communications related to the website PutinTrump.Org. 

e. Evidence indicating how and when the Twitter account was accessed or used, 
to determine the chronological and geographic context of account access, use, 
and events relating to the crime under investigation and to the Twitter account 
owner; 

f. Evidence indicating the Twitter account owner’s state of mind as it relates to 


the crime under investigation; 
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g. The identity of the person(s) who created or used the user ID, including 
records that help reveal the whereabouts of such person(s). 

h. The identity of the person(s) who communicated with the accounts about 
matters related to 18 U.S.C. § 1030, including records that help reveal their 


whereabouts. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 


District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH 


Case: 1:17-mj-00982 

Assigned To : Howell, Beryl A. 

Assign. Date : 12/19/2017 

Description: Search and Seizure Warrant 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern _ Districtof _ -California 


(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before January 2, 2018 (not to exceed 14 days) 
M in the daytime 6:00 a.m. to 10:00 p.m. © at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell 
(United States Magistrate Judge) 


© Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) O until, the facts justifying, the later specific date of 


Date and time issued: apr [ bi = EA oly fez - MODY CE” 


Judge's signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


1 declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


"Printed name and title 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


y 7 
UNITED STATES DISTRICT COURT 
DEC 19 201 


for the ; 


District of Columbia Clerk, U.S. District & Bankrupte 
Courts for the Disteletot Golmmbte 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH 


APPLICATION FOR A SEARCH WARRANT 


Case: 1:17-mj-00982 

Assigned To : Howell, Beryl A. 

Assign. Date : 12/19/2017 

Description: Search and Seizure Warrant 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A. 

located in the Northern _ District of California , there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment B. 


This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 
contraband, fruits of crime, or other items illegally possessed; 
ow property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. § 1030 Fraud and related activities in connection with computers 
18 U.S.C. § 371; 2 Conspiracy against the United States; Aiding and abetting 
52 U.S.C. § 30121 Foreign contribution ban 


The application is based on these facts: 


See attached Affidavit. 


Continued on the attached sheet. 
O Delayed noticeof ______ days (give exact ending date if more than 30 days: ____ ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Ceny Bhias 


Applicant's signature 


Reviewed by AUSA/SAUSA: 
Aaron Zelinsky (ASC) 7 Amy Anderson, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


Date: 12/19/2017 E LEAMA. hi ELG = 


Judge’s signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 


City and state: Washington, D.C. 
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FILED 


IN THE UNITED STATES DISTRICT COURT DEC { g 2017 
FOR THE DISTRICT OF COT TIMRIA 


Glerk, U-S. District & Bangrust 
Case: 1:17-mj-O0982Zourts for the District of Coflunbte 


Assigned To : Howell, Beryl A. 
Assign. Date : 12/19/2017 
Description: Search and Seizure Warrant 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
[ 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Amy A. Anderson, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 
is I make this affidavit in support of an application for a search warrant for 
information associated with the following email account (hereafter the Target Account), 
idi in more detail in Attachments A and B: 
-i “Target Account”) an email address associated 
with SS GR). described further in Attachment A, maintained by 
Google; 
The information to be disclosed by Google (hereafter “the Provider”) and searched by the 
government is described in the following paragraphs and in Attachments A and B. This affidavit 
is made in support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 
2703(b)(1)(A), and 2703(c)(1)(A). 
2 I am a Special Agent with Federal Bureau of Investigation (“FBI”) assigned to 
FBI Headquarters working directly with the Special Counsel’s Office. I have been a Special 
Agent with the FBI since 2010. Since then, I have conducted national security investigations of 
foreign intelligence services, espionage, and counter proliferation matters. I have training and 


experience related to espionage and foreign intelligence services national security investigations. 


Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 5 of 35 


I have conducted and participated in various investigations involving multiple threat countries as 
well as national security threats and applicable criminal violations. 

3; The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4, Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contains communications relevant to 
violations of 18 U.S.C. § 1030 (fraud and related activities in connection with computers), 52 
U.S.C. § 30121 (foreign contribution ban), 18 U.S.C. § 371 (conspiracy to commit an offense 
against the United States), and 18 U.S.C. § 2 (aiding and abetting). 

JURISDICTION 

5: This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c) XA). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 2711(3)(A)(Gi). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraph 11. 
SUMMARY 

6. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to “Get to 
Assange” in person at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” On or 
about August 1, 2016, STONE also instructed CORSI to have PY Ee (the user of 


the Target Account) contact Julian ASSANGE. On or about August 2, 2016, CORSI responded 


2 
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to STONE that the “word is friend in embassy [ASSANGE] plans 2 more dumps. One shortly 
after_I’m-back. 2nd in October..Impact-planned to.be.very-damaging..... Time.to.let Podesta.to.be 
exposed as in bed w enemy if they are not ready to drop HRC.” Information disclosures 
subsequently occurred on or about the times CORSI predicted: On or about August 12, 2016, the 
day CORSI was scheduled to return to the United States (“shortly after Im back”), Guccifer 2.0 
released hacked information related to the Democratic Congressional Campaign Committee 
(DCCC). On October 7, 2016 (“in October”), WikiLeaks began releasing emails hacked from 
John Podesta’s email account. 

T On or about November 13, 2016, SM, using the Target Account, 
emailed Stone to congratulate him on “tak[ing] the country back,” and stating, “You deserve a 
lot of credit and working with you and Jeri Corsi, who is with me now in London has been a 
great joy.” On or about January 7, 2017, ME using the Target Account emailed 
recipients about John Podesta going “phishing.” 

PROBABLE CAUSE. 
A. Background on Relevant Individuals 
i. Roger STONE 

8. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign’”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. As 


described further below, STONE also maintained contact with individuals employed by the 
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Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick 
GATES. 
ii. Jerome CORSI 

9. Jerome CORSI is a political commentator who, according to publicly available 
information, serves as the “Washington Bureau Chief for Inforwars.com.” According to 
publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 
upcoming disclosures which he relayed to STONE. 
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B. Disclosure of Hacked Information by WikiLeaks During the 2016 Presidential 
Campaign 


11. According to the public and unclassified intelligence report prepared by the 
United States Intelligence Community, Russian intelligence gained access to the Democratic 
National Committee (DNC) networks in July 2015 and maintained that access until at least June 
2016. By March 2016, the Russian military intelligence (General Staff Main Intelligence 
Directorate or “GRU”) probably began cyber operations aimed at the U.S. election. The GRU 
operations resulted in the compromise of personal e-mail accounts within the DNC and other 
Democratic Party officials and political figures. By in or about May 2016, the GRU had 
exfiltrated large volumes of data from the DNC. The DNC headquarters is located at 430 South 
Capitol Street SE, Washington, D.C. 20003. 

12. The public and unclassified intelligence report assessed that: 

a. The GRU used a Twitter account, “Guccifer 2.0” and the website 
DCLeaks.com to release the U.S. victim data obtained in cyber operations publicly and in 
exclusives to media outlets and relayed material to WikiLeaks. 

b. Guccifer 2.0, who claimed to be an independent Romanian hacker, made 
multiple contradictory statements and false claims about his likely Russian identity 
throughout the election. 

ĉ: Content that was taken from e-mail accounts targeted by the GRU in 


March 2016 appeared on DCLeaks.com starting in June 2016. 
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d. The GRU relayed material it acquired from the DNC and senior 
-Democratic.officials.to- WikiLeaks..WikiLeaks.was.mostly_likely..chosen.because.of its 
self-proclaimed reputation for authenticity. Disclosures through WikiLeaks did not 
contain any evident forgeries. 
e. The Kremlin’s principal international propaganda outlet RT (formerly 

Russia Today) has actively collaborated with WikiLeaks. RT’s sdtonimait visited 

WikiLeaks founder Julian ASSANGE at the Ecuadorian Embassy in London in August 

2013, where they discussed renewing his broadcast contract with RT, according to 

Russian and Western media. Russian media has subsequently announced that RT had 

become “the only Russian media company” to partner with WikiLeaks and had received 

access to “new leaks of secret information.” 

13. Onor about June 14, 2016, the Washington Post reported that “Russian 
government hackers” had penetrated the DNC computer network and stole opposition research 
on Donald J. Trump. The Kremlin’s spokesman denied any Russian involvement in the hack. 

14. On or about June 15, 2016, Guccifer 2.0 claimed responsibility for the DNC hack 
and began posting hacked documents. 

15. On or about July 22, 2016, WikiLeaks published about 20,000 emails stolen from 
the DNC. 

16. On or about August 12, 2016, Guccifer 2.0 released personal cellphone numbers 
and email addresses from the files of the Democratic Congressional Campaign Committee 
(DCCC). 

7: On or about August 21, 2016, Roger STONE sent a publicly-available tweet 


referring to John Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it 
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will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” Ina C-SPAN interview that 
same day, Stone reiterated that because-of the work. of.a“‘mutual acquaintance’-of both his.and 
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form 
of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think J ulian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of al! of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

18. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

19. Approximately a half hour later, at 4:32 P.M., WikiLeaks sent out a public Tweet 
reading “RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing 
a link to approximately 2,050 emails that had been hacked from John Podesta’s personal email 
account. WikiLeaks continued to release John Podesta’s hacked emails throughout October 10- 
14, 2016. 


C. Roger STONE’s Private Twitter Messages with Guccifer 2.0, WikiLeaks, and Julian 
ASSANGE. 


20. As discussed above, on or about July 22, 2016, WikiLeaks published 
approximately 20,000 emails stolen from the DNC. 

21. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” Stone wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 


Guccifer 2.0.” 
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22; On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in-the-real #Guccifer2.”.That-same.day, Guccifer 2.0 released-the-personal-cellphone 
numbers and email addresses from the files of the Democratic Congressional Campaign 
Committee (DCCC). 

23. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
Twitter account was reinstated. 

24. On August 14, 2016, Stone sent a private message on Twitter using 
@RogerJStoneJr to Guccifer 2.0, stating he was “delighted” to see the user’s Twitter handle 
reinstated after having been suspended. ! 

25: On August 15, 2016, Guccifer 2.0 replied to Stone at @RogerJStoneJr, stating: 
“wow. thank u for writing back, and thank u for an article about me!!! did you find anything 
interesting in the docs I posted.” 

26. On August 16, 2016, Stone sent a private message using @RogerJStoneJr asking 
Guccifer to retweet an article he had written regarding the ‘rigg[ing]’ of the 2016 presidential 
elections. 

27. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

28. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 


1 On or about August 7, 2017, Chief Judge Beryl! A. Howell issued a search warrant for the Twitter account 
@RogerJStoneJr. 


Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 12 of 35 


Manafort had working with a Washington D.C.-based lobbying firms to influence U.S. policy 
toward Ukraine. 

29. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” 

30. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 
that he expected WikiLeaks to “drop a payload of new documents on a weekly basis fairly soon. 
And that of course will answer the question of exactly what was erased on that email server.” 

Fl; On Saturday, October 1, 2016, using @RogerJStoneJr, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

32. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement — 
which was part of WikiLeaks’ 10-year anniversary celebration — Stone told Infowars that his 
intermediary described this release as the “mother load.” 

33. On Tuesday, October 4, 2016, Stone used @RogerJStoneJr to tweet: “Payload 
coming. #Lockthemup.” 

34. As discussed above, on Friday, October 7, 2016, WikiLeaks began to release 
emails that had been hacked from John Podesta’s personal email account. 

35. On or about October 12, 2016, John Podesta — referring back to Stone’s August 
21, 2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption 
to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the release of his 


emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
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think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[Stone].” Commenting to the Miami Herald, Stone responded: “I have-never_met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin a Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 

36. On or about the next day, October 13, 2016, @RogerJStoneJr sent a private direct 
message to the Twitter account @WikiLeaks. The message read: “Since I was all over national 
TV, cable and print defending WikiLeaks and assange against the claim that you are Russian 
agents and debunking the false charges of sexual assault as trumped up bs you may want to 
rexamine the strategy of attacking me- cordially R.” Less than an hour later, @wikileaks 
responded by direct message: “We appreciate that. However, the false claims of association are 
being used by the democrats to undermine the impact of our publications. Don't go there if you 
don't want us to correct you.” 

37. On October 16, 2016, @RogerJStoneJr sent a direct message to @wikileaks: “Ha! 
The more you \"correct\" me the more people think you're lying. Your operation leaks like a 
sieve. You need to figure out who your friends are.” 

38. On November 9, 2016, one day after the presidential election, @wikileaks sent a 
direct message to @RogerJStoneJr containing a single word: “Happy?” @wikileaks immediately 
followed up with another message less than a minute later: “We are now more free to 


communicate.” 
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39. On March 10, 2017, Stone spoke with The Washington Times and acknowledged 
he had been in contact with Guccifer 2.0 using @RogerJStoneJr. Stone publicly stated that he 
had been in contact with Guccifer 2.0 regarding the DNC hack, and that he had used Twitter’s 
private message system to do so. Stone provided a copy of the private messages to The 
Washington Times. 

40. On or about March 27, 2017, CNN reported that a representative of WikiLeaks, 
writing from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

41. On or about June 4, 2017, @RogerJStoneJr directly messaged @JulianAssange, 
an address associated with Julian Assange in numerous public reports, stating: “Still nonsense. 
As a journalist it doesn't matter where you get information only that it is accurate and authentic. 
The New York Times printed the Pentagon Papers which were indisputably stolen from the 
government and the courts ruled it was legal to do so and refused to issue an order restraining the 
paper from publishing additional articles. If the US government moves on you I will bring down 
the entire house of cards. With the trumped-up sexual assault charges dropped I don't know of 
any crime you need to be pardoned for - best regards. R.” That same day, @JulianAssange 
responded: “Between CIA and DoJ they're doing quite a lot. On the DoJ side that's coming most 


strongly from those obsessed with taking down Trump trying to squeeze us into a deal.” 
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42. Onor about June 10, 2017, @RogerJStonedJr sent a direct message to @wikileaks, 
reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 


D. Roger STONE’s Emails with Jerome CORSI and E ed 


43. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 
issued a search warrant for STONE’s | address, I Emails 
recovered pursuant to that search warrant indicated the following: 

44, On or about June 20, 2016 a. using the Target Account, emailed 
STONE and Paul MANAFORT, the Campaign Chairman, asking to “know immediately how I 
can help” the Campaign. P| also wrote that his “research on Rhodes House” was 
nearing completion. The “Rhodes House” research appears to be a reference to STONE’s 
previous tweet on or about October 13, 2015 that, “In 1969, Bill Clinton was expelled from 
Oxford for raping nineteen-year-old MJ.” Rhodes House is the headquarters of the 
Rhodes Trust, and STONE mentioned {J again to IE 2 month later, as 
discussed below. 

45.  Onor about July 7, 2016, MM, using the Target Account, emailed Stone 
that he had “my tickets to Cleveland[.] [D]o you have my credential pack?” F appears 
to be referencing the Republican National Convention held in Cleveland. 

46. On or about July 25, 2016, ae. using the Target Account, forwarded 
an email to STONE and CORSI with the subject line: “Fwd: The Bill Gates of Turkey wants to 
create a campaign for Donald J Trump in Turkey.” PF wrote: “Do you want to have a 


talk about this? Turkey is for Trump!” Below was a forwarded message sent to the Target 
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Account from an individual who stated that he had been contacted by the “Bill Gates of Turkey, 
in regards to creating a robust campaign for Mr Donald J Trump.” 

47. On or about that same day, July 25, 2016, (approximately three days after 
WikiLeaks began releasing emails hacked from the DNC), SS GJ emailed Roger 
STONE with the subject line, “You need to get to Assange.” The body of the message read: “At 
Ecuadorian Embassy in London and get the pending wikileaks emails...they deal with 
Foundation, allegedly.” 

48. According to records Ny Gi Gl] HE. epproximately ninety 
minutes later STONE called CORSI and they spoke for 26 minutes. 

49. Less than two hours after the phone call to CORSI, STONE emailed CORSI at 
with the subject line, “Get to Assange.” The body of the message read: “Get to Assange [a]t 
Ecuadorian Embassy in London and get pending WikiLeaks emails...they deal with Foundation, 
allegedly.” It appears that STONE cut and pasted the email from J} to CORSI. 

50. On or about July 27, 2016, then-candidate Donald Trump stated in a press 
conference, “Russia, if you are listening, I hope you’re able to find the 30,000 [Hillary Clinton] 
emails that are missing. I think you will probably be rewarded mightily by our press. Let’s see if 
that happens. That will be next.” 

51. On or about July 28, 2016, Roger STONE called Richard GATES (then the 
deputy-chair of the Campaign). The two spoke for approximately twelve minutes. 

32; On or about July 30, 2016, Paul MANAFORT (then the Chairman of the 
Campaign) called STONE. The two spoke for approximately one hour and seven minutes. The 


Government has analyzed toll records from January 1, 2016 to November 9, 2016. Sixty-seven 
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minutes is the longest call (by almost a half-hour) that took place between STONE and 
MANAFORT in this time period. 

53. On or about July 31, 2016, STONE called GATES and the two spoke for 
approximately 5 minutes. Approximately ninety minutes later, STONE emailed CORSI at with 
the subject line, “Call me MON.” ‘lhe Body read: Eo should see Assange[.] B 
should find Bernie sanders brother who called Bill a Rapist — turn him for Trump[.] aa 
should find {J or more proof of Bill getting kicked out.” 

54. On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE: “With family, on 
wedding anniversary Aug 9. Return Home Aug 12. Word is friend in embassy plans 2 more 
dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very damaging . . .Time to 
let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That 
appears to be the game hackers are now about. Would not hurt to start suggesting HRC old, 
memory bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting 
stage for Foundation debacle.” Based on my training, experience, and review of materials in this 
case, it appears that CORSI’s reference to a “friend in embassy [who] plans 2 more dumps” 
refers to Julian ASSANGE, the founder of WikiLeaks, who resided in Ecuador’s London 
Embassy in 2016. As discussed above, Guccifer released information hacked from the DCCC on 
August 12, 2016 (the date CORSI identified as when he would “return home.”). 

593. On or about August 16, 2016, CORSI, emailed STONE a link to a piece CORSI 
had written about STONE titled, “Trump Adviser: WikiLeaks Plotting Email Dump to Derail 


Hillary.” 


14 


Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 18 of 35 


56. On or about August 31, 2016, CORSI, using emailed STONE: “Did you get the 
- Podesta writeup.” STONE replied “yes.” 

57. On or about September 6, 2016, CORSI, emailed STONE: “Roger[,] Is NY Post 
going to use the Pedesta [sic] stuff?” 

58. On or about October 7, 2016, WikiLeaks began releasing the Podesta emails. 

59. On or about October 12, 2016, the same day on which Podesta accused STONE of 
having advance knowledge of the publication of his emails, CORSI emailed STONE with the 
subject line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that, 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” CORSI 
followed up several minutes later with another email to STONE titled, “Podesta talking points,” 
with the text “sent a second time just to be sure you go it.” STONE emailed CORSI, “Got them 
and used them.” 

60. On or about October 17, 2016, CORSI emailed STONE with the subject, “Fwd: 
ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’d dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 


raised him the election.” 
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61. On or about November 1, 2016, D. using the Target Account, emailed 
CORSI and STONE with the subject: “Turkey is a ‘GO’ — FULL GREEN LIGHT” S 
wrote: “My good friend Husyein will be caking [sic] you he is in the Presidents office. The call 
is a go. He has all the information you and DJT need for an article and another October surprise.” 
CORSI emailed back to the ‘l'arget Account and STONE: “And I have everything in progress 
for a phone call tomorrow with DJT. I’m working with Roger Stone to accomplish this — Roger 
is copied above so he is up to date on status.” 

62. On or about November 2, 206 using the Target Account, wrote to 
STONE and CORSI: “The message from President Erdogan has been sent to you for DJT has 
just been sent wrapped in an article about baseball as header. If there is a response please let me 
know.” 

63. On or about November 13, 2016, o g using the Target Account, 
emailed Stone. DENE wrote, “Well, we did it and now have an opportunity of a lifetime to 
take the country back. God is good and we are well placed to steer things well. You deserve a lot 


of credit and working with you and Jeri Corsi, who is with me now in London has been a great 


39 


joy. 
64. On or about January 7, 2017, FS emailed STONE, and 
Pg o 4 (using the Target Account) with the subject line, “in case you need his 
mallres ” Attached to the message was a scan of a business card for John Podesta. Several 
hours later S. using the Target Account, replied to all recipients, “Ha... maybe he 
wants to go phishing with us?” 
65. I know from my training and experience that the term “phishing” is used to refer 


to the practice of sending emails purporting to be from a reputable party in order to induce 
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individuals to reveal personal information, including passwords. Public reports indicate that 
Podesta’s emails were obtaining through a “phishing” scheme. 


E. Pye = Use of the Target Account to Communicate with Other Campaign 
Officials 


66. According to documents produced by the Campaign (both voluntarily Jj 


Sn Pe Ge {22s used the Target Account to correspond with 


individuals throughout the Campaign. For example, on or about October 23, 2015, a. 
using the Target Account, emailed Ø Gi I i 
stated that “[it] was so good talking to you earlier in the week — it has sustained me all week. 
Thank you for your contribution to this campaign and to our great country. I look forward to 


working with you on a host of things.” 


67. On or about February 28, 2016, a. using the Target Account, emailed 
E n E. With the subject line “Trump on Putin.” The text of the 
message read: “Pass this to Donald,” and contained an article by CORSI about how Putin 
“fear[ed] impact on his plans if Trump takes victory.” 

68.  Onor about April 4, 2016, xy. ES EE EE 
PY to introduce an individual who was interested in working with the Trump Campaign. 

69. On or about May 25, 2016, a emailed the Target Account about a book 
he was “toying with the idea of writing.” Ps wrote back noting that, “Roger Stone is 
getting me on the list to go to Cleveland [the site of the Republican National Convention].” 

70. On or about August 30, 106 ae. using the Target Account, emailed 
Steve BANNON to report that he had been writing “op-eds” and strategy pieces, “laboring non 
stop for the Trump campaign even though I am all the way over here in Oxford.” FP 


17 


Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 21 of 35 


wrote that he had been “in constant touch with the campaign, Roger Stone, and Jeri Corsi.” 
a suggested a “clever idea for . . . the first debate.” In his idea, then-candidate Trump 
would present then-candidate Clinton with a “Writ of Indictment,” for “undeniable crimes 
against America, destruction of evidence in the form of mails, and theft of funds to your own 
personal benefit and enrichment.” 


71.  Onor about October 25, 2016, SME. using the Target Account, emailed 


E nnn «222"ding a picce [RI had written about how 
ne a a 
BACKGROUND CONCERNING EMAIL 

72. In my training and experience, I have learned that the Providers provide a variety 
of on-line services, including electronic mail (“email”) and search engines (in the case of Google 
and Yahoo), to the public. The Providers allow subscribers to obtain email accounts at the 
domain names identified in the email addresses contained in Attachment A. Subscribers obtain 
an account by registering with the Providers. During the registration process, the Providers ask 
subscribers to provide basic personal information. Therefore, the computers of the Providers are 
likely to contain stored electronic communications (including retrieved and unretrieved email) 
for their subscribers and information concerning subscribers and their use of services, such as 
account access information, email transaction information, and account application information. 
In my training and experience, such information may constitute evidence of the crimes under 
investigation because the information can be used to identify the account’s user or users. 

73. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 


information can include the subscriber’s full name, physical address, telephone numbers and 
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other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

74. In my training and experience, email providers typically retain certain 
transactional information about the creation and use of each account on their systems. This 
information can include the date on which the account was created, the length of service, records 
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the account 
(such as logging into the account via the provider’s website), and other log files that reflect usage 
of the account. In addition, email providers often have records of the Internet Protocol address 
(“IP address”) used to register the account and the IP addresses associated with particular logins 
to the account. Because every device that connects to the Internet must use an IP address, IP 
address information can help to identify which computers or other devices were used to access 
the email account. 

ISe In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and 
the provider’s support services, as well as records of any actions taken by the provider or user as 


a result of the communications. In my training and experience, such information may constitute 
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evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

76. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, 
information maintained by the email provider can show how and when the account was accessed 
or used. For example, as described below, email providers typically log the Internet Protocol 
(IP) addresses from which users access the email account, along with the time and date of that 
access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time (e.g., location information integrated into an image or video sent 
via SnD Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 


the email account may indicate the owner’s motive and intent to commit a crime (e.g., 
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communications relating to the crime), or consciousness of guilt (e.g., deleting communications 
in an effort to conceal them from law enforcement). 

TH: In my training and experience, information such as search history can help to 
show the state of mind of an individual at the time the search was made, as well as the 
individuals potential advance knowledge of events, as they search to see if the anticipated event 
has occurred. 


INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 


78. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the account in Attachment A and 
particularly described in Section I of Attachment B. Upon receipt of the information described 
in Section I of Attachments B, government-authorized persons will review that information to 
locate the items described in Section II of Attachment B. The items identified in Attachments A 
will also be screened by reviewers not on the prosecution team to identify and filter out 
privileged material. 

CONCLUSION 

79. STONE instructed CORSI to “Get to Assange” at the Ecuadorian Embassy 
regarding upcoming leaks. STONE then instructed CORSI to have oo (the user of the 
Target Account) talk to ASSANGE. CORSI subsequently emailed STONE that “word is friend 
in embassy [ASSANGE] plans 2 more dumps. One shortly after I’m back. 2nd in October. 
Impact planned to be very damaging.... Time to let more than Podesta to be exposed as in bed w 


enemy if they are not ready to drop HRC.” Two releases, one from Guccifer and the other from 
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WikiLeaks, occurred at the times predicted by CORSI. CORSI later emailed STONE “talking 
points” about Podesta. In January, == (using the Target Account), STONE, and 
CORSI received an email from an individual regarding Podesta, and a wrote back, 
using the Target Account, “Ha... maybe he wants to go phishing with us?” 
80. Based on the forgoing, I request that the Court issue the proposed search warrant. 
8l. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 
REQUEST FOR SEALING 
82. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 
Respectfully submitted, 
(hud 2. A pclae 
Amy E. &nderson 


Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this / 7 day of December, 2017. 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 


This warrant applies to information associated with the following Google account: 


Ts 


that is stored at premises owned, maintained, controlled, or operated by Google, Inc., a business 


with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT B 
Particular Things to be Seized 


I. Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 


a. The contents of all e-mails, attachments and chat messages stored in the 
account, including copies of e-mails sent to and from the account, draft e-mails, the 
source and destination e-mails sent addresses associated with each e-mail, the date and 
time at which each e-mail was sent, and the size and length of each e-mail; 


b: All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 


Ci All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 


e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 


f. All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 


g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section I.A.; 
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Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the account described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 
(fraud and related activities in connection with computers), 52 U.S.C. § 30121 (foreign 
contribution ban), 18 U.S.C. § 371 (conspiracy to commit an offense against the United 
States), and 18 U.S.C. § 2 (aiding and abetting) for the period from January 1, 2015 to the 
present, including: 


a. All records, information, documents or tangible materials that relate in any 
way to communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to Julian 
Assange; 


b. All records, information, documents or tangible materials that relate in any 
way to communications or meetings between EEE. Jerome Corsi, Roger 
Stone, and individuals associate with WikiLeaks or Turkey; 

b. All images, messages, communications, calendar entries, search terms, 
and contacts, including any and all preparatory steps taken in furtherance of the above- 
listed offenses; 

c. Communication, information, documentation and records relating to who 
created, used, or communicated with the account or identifier, including records about 
their identities and whereabouts; 


d. Evidence of the times the account was used; 


e. All images, messages and communications regarding wiping software, 
encryption or other methods to avoid detection by law enforcement; 


f. Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 


g. Credit card and other financial information, including but not limited to, 
bills and payment records evidencing ownership of the subject account; 


h. All existing printouts from original storage which concern the categories 
identified in subsection II.A; and 


i. All “address books” or other lists of contacts. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1:17-mj-00982 


INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A. 
Assign. Date : 12/19/2017 


Description: Search and Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non- 
disclosure, the proposed Order would direct Google, an electronic communication and/or remote 
computing services provider headquartered in Mountain View, California not to notify any other 
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or 
content of the Warrant for a period of one year or until further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 

1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 


“district court of the United States . . . that — has jurisdiction over the offense being investigated.” 
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18 U.S.C. § 2711(3)(A)(i). As discussed fully below, acts or omissions in furtherance of the 
offense under investigation occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Google provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Google may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(1)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 
notification. In relevant part, Section 2705(b) provides as follows:' 

(b) Preclusion of notice to subject of governmental access. — A governmental 

entity acting under section 2703 . . . may apply to a court for an order commanding 

a provider of electronic communications service or remote computing service to 

whom a warrant, subpoena, or court order is directed, for such period as the court 

deems appropriate, not to notify any other person of the existence of the warrant, 

subpoena, or court order. The court shall enter such an order if it determines that 

there is reason to believe that notification of the existence of the warrant, subpoena, 

or court order will result in— 


(1) endangering the life or physical safety of an individual; 
(2) flight from prosecution; 


! Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(3) destruction of or tampering with evidence; 
(4) intimidation of potential witnesses; or 
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 
requisite showing about potential consequences of notification: 
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 


government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 


In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

S. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Google not to notify any other person (except attorneys for Google for the purpose of 
receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. At the present time, law enforcement officers of the FBI are conducting an 
investigation into violations related to 18 U.S.C. § 1030 (fraud and related activities in connection 
with computers), 52 U.S.C. § 30121 (foreign contribution ban), 18 U.S.C. § 371 (conspiracy to 
commit an offense against the United States), and 18 U.S.C. § 2 (aiding and abetting), arising out 
of the conduct of Roger Stone, B a. and others. The investigation in ongoing, and 
individuals associated with these offenses are not aware of the investigation. If they are made 
aware of the existence and contents of this search warrant, they may seek to delete additional 


information contained in online platforms or otherwise destroy records related to the investigation. 
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REQUEST FOR SEALING AND NON-DISCLOSURE 


vp In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Google and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal 
advice) for a period of one year or until further order of the Court. Such an order is appropriate 
because the Warrant relates to an ongoing criminal investigation, the full scope of which is neither 
public nor known to the targets of the investigation, and its disclosure may alert these targets to 
the ongoing investigation and its scope. Once alerted to this investigation, potential targets would 
be immediately prompted to destroy or conceal incriminating evidence, alter their operational 
tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid 
future prosecution. In particular, given that they are known to use electronic communication and 
remote computing services, the potential target could quickly and easily destroy or encrypt digital 
evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 

9, There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 


§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 


Case 1:19-mc-00029-CRC Document 29-5 Filed 04/28/20 Page 33 of 35 


compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Google the United States is aware that, absent a court 
order under Section 2705(b) commanding Google not to notify anyone about a legal request, it is 
Google’s policy and practice, upon receipt of a warrant seeking the contents of electronically 
stored wire or electronic communications for a certain account, to notify the subscriber or customer 


of the existence of the warrant prior to producing the material sought. 


WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Google not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year or 
until further order of the Court. 


Respectfully submitted, 


ROBERT S. MUELLER, III 
Special Counsel 


Dated: | Zilol? By: 


Aaron S.J. Zeli 
The Special Qounsel’s Office 
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FILED 


DEC 19 207 
IN THE UNITED STATES DISTRICT COURT 
Clerk, U.S. District & Bankrupte 
FOR THE DISTRICT OF COLUMRIA Courts for the Distriet of Columa i 


Case: 1:17-mj-00982 

Assigned To : Howell, Bery! A. 

Assign. Date : 12/19/2017 

Description: Search and Seizure Warrant 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Google, an electronic communication and/or remote computing service s 
headquartered at 1600 Amphitheatre Parkway, Mountain View, California not to disclose the 
existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C.-§ 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Google for the purpose of receiving legal advice) for a period of one year or until 


further order of the Court. 


MAar 
THE PATA a 


LE BERYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 


In the Matter of the Search of ) 
(Briefly describe the property to be searched ) Case: 1:18-sc-00662 
or identify the person by name and address) ) Assi gn ed To : Howell. B eryl A. 
INFORMATION ASSOCIATED WITH VARIOUS APPLE) Assign. Date : 3/14/2018 
ACCOUNTS Description: Search & Seizure Warrant 
SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern __ District of California _ 
(identify the person or describe the property to be searched and give its location): 


See Attachment A. 


J find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B. 


YOU ARE COMMANDED to execute this warrant on or before _ March 28, 2018 (not to exceed 14 days) 
@ in the daytime 6:00 a.m. to 10:00 p.m. O at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to _ Hon. Beryl A. Howell 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) O until, the facts justifying, the later specific date of 


Date and time issued: 2/ / Y| z016 af aG2HN SEMI: Ae 


i Judge ’s signature 


Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: 
Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 
Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the following Apple Accounts: 


that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., a business 


with offices located at 1 Infinite Loop, Cupertino, California 95014. 
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ATTACHMENT B 
Particular Things to be Seized 
I. Information to be disclosed by Apple 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of Apple, including any messages, records, files, logs, or information that 
have been deleted but are still available to Apple, or have been preserved pursuant to a request 
made under 18 U.S.C. § 2703(£), Apple is required to disclose the following information to the 
eevernment in unencrypted form whenever available, for each account or identifier listed in 


Attachment A: 


a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, methods of connecting, and means and source of payment 


(including any credit or bank account numbers); 


b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 


(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
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Mobile Equipment Identifiers (“‘MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMST”), and International Mobile 


Station Equipment Identities (‘IMEI’); 


es The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 


all attachments; 


d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 


to each instant message; 


e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWorks 


(including Pages, Numbers, and Keynote), iCloud Tabs, and iCloud Keychain, and all address 
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books, contact and buddy lists, notes, reminders, calendar entries, images, videos, voicemails, 


device settings, and bookmarks; 


f Al activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, mail logs, 
iCloud logs, iTunes Store and App Store logs (including purchases, downloads, and updates of 
Apple and third-party apps), messaging and query logs (including iMessage, SMS, and MMS 
messages), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center 
logs, Find my iPhone logs, logs associated with iOS device activation and upgrades, and logs 


associated with web-based access of Apple services (including all associated identifiers); 


g. All records and information regarding locations where the account was accessed, 


including all data stored in connection with Location Services; 
h. All records pertaining to the types of service used; 


i. All records pertaining to communications between Apple and any person 


regarding the account, including contacts with support services and records of actions taken; and 


j. All files, keys, or other information necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 


fileinfolist.txt files). 
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Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C.§ 1030 (fraud and 
related activities in connection with computers), 18 U.S.C. § 2 (aiding and abetting), and 18 
U.S.C. § 371 (conspiracy to commit an offense against the United States), for the period January 
2015 to the present, including: 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange; 


b. All images, messages, communications, calendar entries, search terms, 
and contacts, including any and all preparatory steps taken in furtherance of the above- 
listed offenses; 


C: Communication, information, documentation and records relating to who 
created, used, or communicated with the account or identifier, including records about 
their identities and whereabouts; 


d. Evidence of the times the account was used; 


e. All images, messages and communications regarding wiping software, 
encryption or other methods to avoid detection by law enforcement; 


f. Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 


g. Credit card and other financial information, including but not limited to, 
bills and payment records evidencing ownership of the subject account; 


h. All existing printouts from original storage which concern the categories 
identified in subsection II.A; and 


i. All “address books” or other lists of contacts. 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT MAR 14 2018 
for the sia 
Clerk, U.S. Distric : . 
District of Columbia . Courts for the District hae 
In the Matter of the Search of ) Case: 1:18-sc-00662 
Briefly describe th erty to be searched iin 
‘or identify the person by name and address) } Assigned To : Howell, Beryl A. 
INFORMATION ASSOCIATED WITH VARIOUS APPLE ) Assign. Date : 3/14/2018 
ACCOUNTS Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


l, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A. 

located inthe | Northern District of California , there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment B. 


This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 
contraband, fruits of crime, or other items illegally possessed; 
f property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. §§ 2, 3, 4, 371, 1343 Aiding & Abetting (§2); Accessory after the Fact (§3); Misprison of a Felony (§4); 
and 1349; and Conspiracy (§371); Computer Fraud (§1030); Wire Fraud (§1343); Attempt and 


52 U.S.C. § 30121(a)(1)(C) Conspiracy to Commit Wire Fraud (§1349); and Foreign Expenditure Ban (§30121) 
The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 


O Delayed noticeof days (give exact ending date if more than 30 days: __ ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


fart Mee 


Reviewed by AUSA/SAUSA: Applicant's signature 


Aaron Zelinsky (ASC) Curtis Heide, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


wre g> Le 
Date: _ 3/14/2018 a Let , VE de ZZ 


Judge's signature 


City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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PILED 


IN THE UNITED STATES DISTRICT COURT MAR 14 2018 
FOR THE DISTRICT OF COLUMBIA 


Clark Us ie 


Courts for the oe ankri pley- 
IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-00662 orGotamnbig 
INFORMATION ASSOCIATED WITH Assigned To : Howell, Bery! A. 
VARIOUS APPLE ACCOUNTS Assign. Date : 3/14/2018 
uai : ——— Description: Search & Seizure Warrant 
AFFIDAVIT IN SUPPORT OF 


AN APPLICATION FOR A SEARCH WARRANT 

I, Curtis Heide, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1, I make this affidavit in support of an application for ‘a search warrant for 


information associated with the following Apple Accounts: 


that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., a business 
with offices located at 1Infinite Loop, Cupertino, California 95014. The information to be 
disclosed by Apple and searched by the government is described in the following paragraphs and 
in Attachments A and B. This affidavit is made in support of an application for a search warrant. 

Qi I, Curtis A. Heide, have been a Special Agent with the Federal Bureau of 
investigation for 11 years. In the course of my duties, I have been responsible for investigating 
federal crimes and national security matters involving both counterintelligence and issues related 
to cybersecurity. 

a The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 


forth all of my knowledge about this matter. 
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4. Based on my training and experience and the facts as set forth in this affidavit, 


--—— —--- there is-probable-cause-to-believe-that the-Larget-Accounts-contain-communications relevant to—- --- 


violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 
U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), , 18 U.S.C. § 1030 
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 
(attempt and conspiracy to commit wire fraud), , and 52 U.S.C. § 30121 (foreign contribution 
ban) (the “Subject Offenses”). ! 

3. As set forth below, Roger STONE communicated directly via Twitter with 
WikiLeaks, Julian Assange, and Guccifer 2.0, a Twitter account used to disseminate hacked 
information. STONE, using his J Account, also emailed instructions to Jerome CORSI to 
“Get to Assange” in person at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” 
CORSI emailed STONE back that it was “Time to let more than Podesta to be exposed” (before 
any of Podesta’s emails were leaked). After Podesta’s emails were leaked, CORSI emailed 
STONE “talking points” about Podesta. CORSI also emailed Stone to convey information “from 
a very trusted source” regarding Julian ASSANGE, WikiLeaks, and potential future disclosures. 
BANNON also sent text messages to STONE discussing potential upcoming leaks by 
ASSANGE. The Target Accounts are STONE’s iCloud accounts, which are registered to the 
email accounts STONE used to communicate with CORSI. 


JURISDICTION 


' Federal law prohibits a foreign national from making, directly or indirectly, an expenditure or independent 
expenditure in connection with federal elections. 52 U.S.C. § 30121(a)(1)(C); see also id. § 30101(9) & (17) 
(defining the terms “expenditure” and “independent expenditure”). 
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6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
—--—_—---— competent jurisdiction”-as-defined-by-18-U-S-C-§ 27111d-§§2703(a)(b) Aj} (A)-& (ce) (A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 2711(3)(A)G@). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraph 7. 
PROBABLE CAUSE 

A. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed 

Hacking Activity during the 2016 Presidential Election 

Os On October 7, 2016, the U.S. Department of Homeland Security and Office of the 
Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election.” In the report, the USIC 
assessed the following: 

8. The U.S. Intelligence Community (USIC) is confident that the Russian 
Government directed the recent compromises of e-mails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked e-mails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are 
intended to interfere with the US election process. Such activity is not new to Moscow—the 


Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 


2 “Joint Statement from the Department Of Homeland Security and Office of the Director of National Intelligence on 
Election Security,” Oct. 7, 2016, available at ttps://www.dhs.gov/news/2016/10/07/joint-statement-department- 
homeland-security-and-office-director-national. 
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influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
- -that-only Russia’s senior-most officials could have authorized these activities 

9, On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

10. [] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed 
at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

LL, In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

12. With respect to hacking activity, the USIC assessed: “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” In addition, “In July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC further assessed that cyber 


3 “Assessing Russian Activities and Intentions in Recent US Elections,’ Jan. 6, 2017, available at 
https://www.dni.gov/files/documents/ICA_2017_01.pdf. 


Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 13 of 38 


operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU) 
“resulted-in the compromise of the personal e-mail accounts of Democratic Party officials and 
political figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

13: With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

ie Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his likely Russian identity throughout the 
election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted 
with journalists. 

A. Roger Stone’s Disclosed Interactions with Guccifer 2.0 and WikiLeaks. 

2. Roger Stone is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until he was fired in August 2015. Although Stone had no 
official relationship with the Campaign thereafter, Stone maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. 

ae As discussed further below, Stone made a number of public references to 
WikiLeaks and its release of DNC-related emails. Stone has also stated that he was in contact via 
Twitter with Guccifer 2.0. 

4. On June 14, 2016, news reports indicated that the computer systems of the DNC 
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC 

hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June, 


21, 2016 release of hacked documents. 
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5, On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

6. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” Stone wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” Stone embedded publicly available Tweets from Guccifer 2.0 in the article and 
wrote: “Here’s Guccifer 2.0°s website. Have a look and yov’ll see he explains who he is and why 
he did the hack of the DNC.” Stone also stated: “Guccifer 2.0 made a fateful and wise decision. 
He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for 
themselves how the Democrats had rigged the game.” 

7 On August 8, 2016, Stone addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard to the 
October surprise, what would be your forecast on that given what Julian Assange has intimated 
he’s going to do?” Stone responded: “Well, it could be a number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 
served as an intermediary. 

8. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 


u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
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numbers and email addresses from the files of the Democratic Congressional Campaign 
Committee (DCCC). 

9; On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
Twitter account was reinstated. 

10. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “1’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

11. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 
Manafort had working with a Washington D.C.-based lobbying firms to influence U.S. policy 
toward Ukraine. 

12. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same day, 
Stone reiterated that because of the work of a “‘mutual acquaintance’ of both his and [Assange], 
the public [could] expect to see much more from the exiled whistleblower in the form of 
strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 


Clinton aides, believe they deleted. That and alot more. These are like the Watergate tapes.” 


Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 16 of 38 


13. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 
that he expected WikiLeaks to “drop a payload of new documents on a weekly basis fairly soon. 
And that of course will answer the question of exactly what was erased on that email server.” 

14. On Saturday, October 1, 2016, using @RogerJStoneJr, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

15: On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement — 
which was part of WikiLeaks’ 10-year anniversary celebration — Stone told Infowars that his 
intermediary described this release as the “mother load.” On Tuesday, October 4, 2016, Stone 
used @RogerJStoneJr to tweet: “Payload coming. #Lockthemup.” 

16. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

TA Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

18. | WikiLeaks continued to release John Podesta’s hacked emails throughout October 
10-21, 2016. On October 12, 2016, John Podesta — referring back to Stone’s August 21, 2016 C- 
SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - or at 
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails] 
and the Trump campaign had advanced warning about what Assange was going to do. I think 


there’s at least a reasonable belief that [Assange] may have passed this information on to 
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[Stone].” Commenting to the Miami Herald, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 

19, On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

B. Roger Stone’s Private Twitter Direct Messages with WikiLeaks and Julian Assange. 

20. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 

21. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 


strategy of attacking me- cordially R.” 
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22. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

23. On October 16, 2016, @RogerJStoneJr sent a direct message to @wikileaks: “Ha! 
The more you \"correct\" me the more people think you're lying. Your operation leaks like a 
sieve. You need to figure out who your friends are.” 

24. On November 9, 2016, one day after the presidential election, @wikileaks sent a 
direct message to @RogerJStoneJr containing a single word: “Happy?” @wikileaks immediately 
followed up with another message less than a minute later: “We are now more free to 
communicate.” 

25. In addition, @RogerJStoneJr also exchanged direct messages with Julian 
Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly 
messaged @JulianAssange, an address associated with Julian Assange in numerous public 
reports, stating: “Still nonsense. As a journalist it doesn't matter where you get information only 
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don't know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they're doing quite a lot. On the 
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to 


squeeze us into a deal.” 
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26. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 


C. Roger Stone’s Private Email and Text Messages Regarding WikiLeaks, Julian 
Assange, Russia, and John Podesta 


2T: On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE’s — address, PY On October 


17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE’s ee address, 
EE Information recovered pursuant to those search warrant indicated the 
following: 

28. On July 25, 2016, STONE sent an email from his (eet Account to Jerome 
CORSI, an author and political commentator, with the subject line, “Get to Assange.” The body 
of the message read: “Get to Assange [a]t Ecuadorian Embassy in London and get pending 
WikiLeaks emails...they deal with Foundation, allegedly.” 

29, On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed the [J Account, “Word is 
friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to 
be very damaging . . .Time to let more than Podesta to be exposed as in bed w enemy if they are 
not ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to 
start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much 
of next dump focus, setting stage for Foundation debacle.” Based on my training, experience, 


and review of materials in this case, it appears that CORSI’s reference to a “friend in embassy 
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[who] plans 2 more dumps” refers to Julian ASSANGE, the founder of WikiLeaks, who resided 
in Ecuador’s London Embassy in 2016. 

30. On or about August 5, 2016, C. an associate of STONE’s emailed 
him a link to a poll indicated that Clinton lea Trump by 15 points. STONE responded “enjoy it 
while u can[.] I dined with my new pal Julian Assange last night.” m subsequently 
stated to investigators that, around the same time, STONE told him he had gone to London to 
meet ASSANGE. S also stated that in 2018, (J told STONE he would be 
interviewed by the FBI and would have to divulge the conversation about meeting ASSANGE. 
STONE told i he was joking and had not actually met Assange. 

al. On or about August 16, 2016, CORSI emailed STONE a link to a piece CORSI 
had written about STONE titled, “Trump Adviser: WikiLeaks Plotting Email Dump to Derail 
Hillary.” 

32; On August 19, 2016, Bannon sent Stone a text message asking if he could talk 


that morning. On August 20, 2016, Stone replied, “when can u talk???” 


33. Onor about August 31, 2016, CORSI emailed STONE: “Did you get the Podesta 
writeup.” STONE replied “yes.” 

34. On September 4, 2016, Stone texted Bannon that he was in New York City for a 
few more days, and asked if Bannon was able to talk. 

35. On or about September 6, 2016, CORSI emailed STONE: “Roger[,] Is NY Post 
going to use the Pedesta [sic] stuff?” 

36. On September 7, 2016, Stone and Bannon texted to arrange a meeting on 


September 8, 2016 at the Warner Center in New York. 


12 


Case 1:19-mc-00029-CRC Document 29-6 Filed 04/28/20 Page 21 of 38 


37. On September 7, 2016, Bannon texted Stone asking him if he could “come by 


trump tower now???” 


38. On September 8, 2016, Stone and Bannon texted about arranging a meeting in 
New York. 
39. On October 3, 2016, an associate of Stone emailed Stone and asked: “Assange — 


what’s he got? Hope it’s good.” Stone wrote back, “It is. Pd tell Bannon but he doesn’t call me 
back. My book on the TRUMP campaign will be out in Jan. Many scores will be settled.” The 
associate forwarded the email to Bannon and wrote: “You should call Roger. See below. You 
didn’t get from me.” Bannon wrote back, “I’ve got important stuff to worry about.” The 
associate responded, “Well clearly he knows what Assange has. I’d say that’s important.” 

40. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information "affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process." ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next 10 weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

41. Later that day, BANNON emailed STONE, “What was that this morning???” 
STONE replied, “Fear. Serious security concern. He thinks they are going to kill him and the 
London police are standing done [sic]. “ BANNON wrote back, “He didn’t cut deal w/ 


clintons???” Stone replied, “Don't think so BUT his lawyer [J is a big democrat.” 


iS 
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42. | When BANNON spoke with investigators during a voluntary proffer on February 
14, 2018, he initially denied knowing whether the October 4, 2017 email to STONE was about 
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE 
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 

43. On or about October 7, 2016, WikiLeaks began releasing the Podesta emails. 

44. On or about October 12, 2016, the same day on which Podesta accused STONE of 
having advance knowledge of the publication of his emails, CORSI emailed STONE on both the 
email accounts, with a subject line “Podesta talking points.” Attached to the email was a file 
labeled, “ROGER STONE podesta talking points Oct 12 2016.docx.” The “talking points” 
included the statement that “Podesta is at the heart of a Russian-government money laundering 
operation that benefits financially Podesta personally and the Clintons through the Clinton 
Foundation.” CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you go it.” STONE emailed 
CORSI back via the [J Account, “Got them and used them.” 

45. On or about October 17, 2016, CORSI emailed the STONE with the subject, 
“Fwd: ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded 
an email with the header information stripped out, showing only the body text. The email read, 
“Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on 
them if they move to extradite him. My guess is that he has a set of dead man files that include 
Hillary. It’s what they used to call a ‘Mexican stand off].]’ Only hope is that if Trump speaks out 


to save him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, 
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Assange can kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s 


bluff and raised him the election.” 


46. Onor about January 7, 2017, i emailed STONE, CORSI, and 
GEE ith the subject line, “in case you need his mail......... ” Attached to the 
message was a scan of a business card for John Podesta. Several hours later, Ps replied 
to all recipients: “Ha... maybe he wants to go phishing with us?” 

47. I know from my training and experience that the term “phishing” is used to refer 
to the practice of sending emails purporting to be from a reputable party in order to induce 
individuals to reveal personal information, including passwords. Public reports indicate that 
Podesta’s emails were obtaining through a “phishing” scheme. 

D. STONE’s Recent Public Statements Regarding Contact with Assange 

48. As described above, STONE stated that on October 12, 2016 that he was in 
contact with ASSANGE via a “a mutual friend who’s traveled to London several times,” and that 
“everything I know is through that channel of communications.” 

49. On March 13, 2018, the Washington Post published an article about STONE’s 
previous claims of contact with Assange.* The cited an anonymous source who claimed to have a 
conversation with STONE in the “spring of 2016” where STONE indicated that he had learned 
from “Julian Assange that his organization had obtained emails that would torment senior 
Democrats such as John Podesta,” and that the conversation occurred before it became publicly 


known that hackers had obtained the “emails of Podesta and of the Democratic National 


4 https://www.washingtonpost.com/politics/roger-stone-claimed-contact-with-wikileaks-founder-julian-assange-in- 
2016-according-to-two-associates/20 | 8/03/13/a263 f842-2604-1 1e8-b79d-f3d93 1db7f68_story.html?hpid=hp_rhp- 
top-table-main_stone-656am%3 Ahomepage%2F story 
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Committee.” The article also cited [J statements that STONE stated he had spoken to 
ASSANGE. The article cited STONE denying any advance notice about the hacked emails or 
any “contact with Assange.” The Article stated that STONE “said he only recalled having one 
conversation with anyone in which he alluded to meeting the WikiLeaks founder — a comment he 
said he made as a joke to Nunberg.” STONE was quoted as stating, “The allegation I met with 
Assange, or asked for a meeting or communicated with Assange, is provably false.” 

50. The article also stated that STONE told the House Intelligence Committee in 
September 2017 that his August 21 tweet was meant as a prediction that Podesta’s business 
opportunities would come under scrutiny after Paul MANAFORT was forced to resign amid 
allegations about his work for a pro-Russian party in Ukraine. MANAFORT resigned from the 
Campaign on or about August 19, 2016. CORSI’s email to STONE about WikiLeaks and “Time 
to let more than Podesta to be exposed as in bed w.enemy if they are not ready to drop HRC,” 
occurred on August 2, 2016, over two weeks before MANAFORT’s resignation. 

E. STONE’s use of the Target Accounts 

SL. On November 21, 2017, Chief Judge Beryl A. Howell signed an order pursuant to 
18 U.S.C. §2703(d) for header information related to the Target Accounts. Pursuant to that 
order, Apple provided the following information: 


52. Target Account 1 has the Apple ID I, an email address 


associated with STONE discussed above. The associated email address is 


E e company registered as the account user is Citroen Associates, a 


company linked to STONE by investigators. Additionally, the “rescue email” is 


EE. Which is STONE’s {J account. IP login information shows that the 


account was in use as of the time of the service of the Order According to Apple, the system has 
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been set to a “Full iCloud” backup. I know from my training and experience that a full iCloud 
backup can include other databases and messaging features, including third party messaging 
programs. Often individuals are unaware that the information is being stored in their iCloud, and 
therefore the iCloud may contain additional communications not contained in the standard mail 


accounts. STONE’s email account MD) also contains messages regarding 


his iCloud account, including an indication that iCloud storage was “full.” STONE also used 


Target Account 1’s associated iCloud email account, (IM, to send an email 


in March, 2017. 


53. Target Account 2 has the Apple ID I, an email address 


associated with STONE. Target Account 2 is registered to “Roger Stone,” and according to 
information provided by Apple pursuant to the § 2703(d) order, contains a full iCloud backup as 


well. The account is currently locked. 


INFORMATION REGARDING APPLE ID AND iCLOUD* 


54. Apple is a United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 


the Mac OS operating system. 


> The information in this section is based on information published by Apple on its website, including, but 
not limited to, the following document and webpages: “U.S. Law Enforcement Legal Process Guidelines,” available 
at http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf; “Create and start using an Apple ID,” 
available at https://support.apple.com/en-us/HT203993; “iCloud,” available at http://www.apple.comi/icloud/; 
“iCloud: iCloud storage and backup overview,” available at https://support.apple.com/kb/PH12519; and “iOS 
Security,” available at http://images.apple.com/privacy/docs/iOS Security Guide.pdf. 
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55. Apple provides a variety of services that can be accessed from Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

a. Apple provides email service to its users through email addresses at the 
domain names mac.com, me.com, and icloud.com. 

b. iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (“iMessages”) 
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to 
conduct video calls. 

c. iCloud is a file hosting, storage, and sharing service provided by Apple. 
iCloud can be utilized through numerous iCloud-connected services, and can also be used to 
store iOS device backups and data associated with third-party apps. 

d. iCloud-connected services allow users to create, store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and 
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 
to share those images and videos with other Apple subscribers. iCloud Drive can be used to 
store presentations, spreadsheets, and other documents. iCloud Tabs enables iCloud to be used 
to synchronize webpages opened in the Safari web browsers on all of the user’s Apple devices. 
iWorks Apps, a suite of productivity apps (Pages, Numbers, and Keynote), enables iCloud to be 


used to create, store, and share documents, spreadsheets, and presentations. iCloud Keychain 
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enables a user to keep website username and passwords, credit card information, and Wi-Fi 
network information synchronized across multiple Apple devices. 

E Game Center, Apple’s social gaming network, allows users of Apple 
devices to play and share games with each other. 

f. Find My iPhone allows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. 

g. Location Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. 

h. App Store and iTunes Store are used to purchase and download digital 
content. iOS apps can be iene and downloaded through App Store on iOS devices, or 
through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS. Additional digital content, including music, movies, and television shows, can be 
purchased through iTunes Store on iOS devices and on desktop and laptop computers running 


either Microsoft Windows or Mac OS. 


56. Apple services are accessed through the use of an “Apple ID,” an account created 
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 


syncing mechanism. 


57. | An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 


(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
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third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 


associated with an Apple ID by the user. 


58. Apple captures information associated with the creation and use of an Apple ID. 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers. The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgot” pages on 
Apple’s website. In addition, Apple captures the date on which the account was created, the 
length of service, records of log-in times and durations, the types of service utilized, the status of 
the account (including whether the account is inactive or closed), the methods used to connect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access 


the account, and other log files that reflect usage of the account. 


59. Additional information is captured by Apple in connection with the use of an 
Apple ID to access certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 


invitation logs” for FaceTime calls, and “mail logs” for activity over an Apple-provided email 
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account. Records relating to the use of the Find My iPhone service, including connection logs 


and requests to remotely lock or erase a device, are also maintained by Apple. 


60. Apple also maintains information about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“ICCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, eine the Media Access Control address (“MAC 
address”), the unique device identifier (“UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
captured when used to access services through icloud.com and apple.com. Apple also retains 
records related to communications between users and Apple customer service, including 
communications regarding a particular Apple device or service, and the repair history for a 


device. 


61. Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, including: email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (i{Works and iCloud Drive); and 
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain). 


iCloud can also be used to store iOS device backups, which can contain a user’s photos and 
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videos, Messages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call history, contacts, calendar events, reminders, 
notes, app data and settings, and other data. Records and data associated with third-party apps 
may also be stored on iCloud; for example, the iOS app for WhatsApp, an instant messaging 
service, can be configured to regularly back up a user’s instant messages on iCloud. Some of 
this data is stored on Apple’s servers in an encrypted form but can nonetheless be decrypted by 


Apple. 


62. In my training and experience, evidence of who was using an Apple ID and from 
where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 


suspicion. 


63. The stored communications and files connected to an Apple ID may provide 
direct evidence of the offenses under investigation. For example, stored iMessage 
communications, voicemails, and emails may contain conversations with foreign government 
officials similar to those described above in PAPADOPOULOS’s LinkedIn and Gmail accounts. 
Based on my training and experience, instant messages, emails, voicemails, photos, videos, and 
documents are often created and used in furtherance of criminal activity, including to 


communicate and facilitate the offenses under investigation. 


64. In addition, the user’s account activity, logs, stored electronic communications, 


and other data retained by Apple can indicate who has used or controlled the account. This “user 
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attribution” evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence. For example, subscriber information, email and messaging logs, 
documents, and photos and videos (and the data associated with the foregoing, such as geo- 
location, date and time) may be evidence of who used or controlled the account at a relevant 
time. As an example, because every device has unique hardware and software identifiers, and 
because every device that connects to the Internet must use an IP address, IP address and device 
identifier information can help to identify which computers or other devices were used to access 
the account. Such information also allows investigators to understand the geographic and 


chronological context of access, use, and events relating to the crime under investigation. 


65. Account activity may also provide relevant insight into the account owner’s state 
of mind as it relates to the offenses under investigation. For example, information on the account 
may indicate the owner’s motive and intent to commit a crime (e.g., information indicating a 
plan to commit a crime), or consciousness of guilt (e.g., deleting account information in an effort 


to conceal evidence from law enforcement). 


66. Other information connected to an Apple ID may lead to the discovery of 
additional evidence. For example, the identification of apps downloaded from App Store and 
iTunes Store may reveal services used in furtherance of the crimes under investigation or 
services used to communicate with co-conspirators. For instance, if there are secured and 
encrypted communication applications downloaded from the App Store, that can show an 
attempt to hide information from investigators. In addition, emails, instant messages, Internet 
activity, documents, and contact and calendar information can lead to the identification of co- 


conspirators and instrumentalities of the crimes under investigation. 
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67. Therefore, Apple’s servers are likely to contain stored electronic communications 
and information concerning subscribers and their use of Apple’s services. In my training and 
experience, such information may constitute evidence of the crimes under investigation including 


information that can be used to identify the account’s user or users. 
CONCLUSION 


68. STONE instructed CORSI to “Get to Assange” at the Ecuadorian Embassy 
regarding upcoming leaks, and CORSI emailed Stone on the = Account that it was “Time 
to let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC.” 
STONE also texted and emailed BANNON about potential forthcoming leaks from ASSANGE 
and WikiLeaks. There is therefore probable cause to believe that evidence of the DNC hack and 
the hacking of other emails associated with the 2016 election will be found in the information 
associated with the Target Accounts. 

69. Based on the forgoing, I request that the Court issue the proposed search warrant. 

70. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 


required for the service or execution of this warrant. 
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REQUEST FOR SEALING 
71. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Federal Bureau of Investigation 


Subscribed and sworn to before me on this / V1 al of March, 2018. 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the following Apple Accounts: 


that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., a business 


with offices located at 1 Infinite Loop, Cupertino, California 95014. 
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ATTACHMENT B 
Particular Things to be Seized 
I. Information to be disclosed by Apple 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of Apple, including any messages, records, files, logs, or information that 
have been deleted but are still available to Apple, or have been preserved pursuant to a request 
made under 18 U.S.C. § 2703(£), Apple is required to disclose the following information to the 
eevernment in unencrypted form whenever available, for each account or identifier listed in 


Attachment A: 


a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, methods of connecting, and means and source of payment 


(including any credit or bank account numbers); 


b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 


(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
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Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMST”), and International Mobile 


Station Equipment Identities (‘IMEI’); 


es The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 


all attachments; 


d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 


to each instant message; 


e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWorks 


(including Pages, Numbers, and Keynote), iCloud Tabs, and iCloud Keychain, and all address 
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books, contact and buddy lists, notes, reminders, calendar entries, images, videos, voicemails, 


device settings, and bookmarks; 


f Al activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, mail logs, 
iCloud logs, iTunes Store and App Store logs (including purchases, downloads, and updates of 
Apple and third-party apps), messaging and query logs (including iMessage, SMS, and MMS 
messages), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center 
logs, Find my iPhone logs, logs associated with iOS device activation and upgrades, and logs 


associated with web-based access of Apple services (including all associated identifiers); 


g. All records and information regarding locations where the account was accessed, 


including all data stored in connection with Location Services; 
h. All records pertaining to the types of service used; 


i. All records pertaining to communications between Apple and any person 


regarding the account, including contacts with support services and records of actions taken; and 


j. All files, keys, or other information necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 


fileinfolist.txt files). 
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Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C.§ 1030 (fraud and 
related activities in connection with computers), 18 U.S.C. § 2 (aiding and abetting), and 18 
U.S.C. § 371 (conspiracy to commit an offense against the United States), for the period January 
2015 to the present, including: 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange; 


b. All images, messages, communications, calendar entries, search terms, 
and contacts, including any and all preparatory steps taken in furtherance of the above- 
listed offenses; 


C: Communication, information, documentation and records relating to who 
created, used, or communicated with the account or identifier, including records about 
their identities and whereabouts; 


d. Evidence of the times the account was used; 


e. All images, messages and communications regarding wiping software, 
encryption or other methods to avoid detection by law enforcement; 


f. Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 


g. Credit card and other financial information, including but not limited to, 
bills and payment records evidencing ownership of the subject account; 


h. All existing printouts from original storage which concern the categories 
identified in subsection II.A; and 


i. All “address books” or other lists of contacts. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 


Case: 1:18-sc-01518 

Assigned To : Howell, Beryl A. | 
Assign. Date : 5/4/2018 | 
Description: Search & Seizure Warrant i 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH THE GOOGLE 
ACCOUNT 


Or ae ere oe Rs, AO OR a 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California 
(identify the person or describe the property to be searched and give its location): 


See Attachment A. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B. 


YOU ARE COMMANDED to execute this warrant on or before May 18, 2018 (not to exceed 14 days) 
Mí in the daytime 6:00 a.m. to 10:00 p.m. Oat any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) O until, the facts justifying, the later specific date of 


Date and time issued: SE 220 Po ELTA Aa LACE? 


Judge's signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 
Printed name and title 


“Rett: 
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AO 93 (Rev. £1/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 
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UNITED STATES DISTRICT COURT Glerk, U.S, District & Bankru 
r: & ruptey 
FOR THE DISTRICT OF COLUMBIA — gayris for the District of Cala 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-01518 
INFORMATION ASSOCIATED WITH Assigned To : Howell Beryl A 
THE GOOGLE ACCOUNT Assign. Date : 5/4/2018 


Description: Search & Seizure Warrant 


ORDER 


The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Google LLC, an electronic communication and/or remote computing services with 
headquarters in Mountain View, California, not to disclose the existence or contents of the Warrant 
pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compaing governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Google for the purpose of receiving legal advice) for a period of one year unless 


otherwise ordered by the Court. 


G few 


THE HONORABLE BERYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 


s7 4] r/3 


Date 
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AO 106 (Rev. 04/10) Application for a Search Warrant, 


UNITED STATES DISTRICT COURT 
for the ay 
District of Columbia i 


TAS 


FILED 


pak, 


Giark, US, District & Bankrupte 
Courts for the Distr Gol nA 
no 1:18-sc-01518 ieee 
ssigned To : Howell Beryl 
; A. 
Assign. Date - 5/4/2018 ‘i 


Description: Search & Seizure Warrant 


In the Matter of the Search of 
Md ad ibe th ty to b eched 
CODE E E A 
INFORMATION ASSOCIATED WITH THE GOOGLE 
ACCOUNT 


N N N S S Sear 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property to be searched and give its location): 


See Attachment A. ; 
located in the Northern District of California , there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment B. 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
om evidence of a crime; l 
of contraband, fruits of crime, or other items illegally possessed; 
@ property designed for use, intended for use, or used in committing a crime; 
Ga person to be arrested or a person who is unlawfully restrained, 


The search is related to a violation of: 


Code Section - Offense Description 
18 U.S.C. § 2 aiding and abetting 
et al. see attached affidavit 


The application is based on these facts: 


See attached Affidavit. 


( Continued on the attached sheet. 
1 Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Applicant's signature 


Andrew Mitchell, Supervisory Special Agent, FBI. 
Printed name and title 


Sworn to before me and signed in my presence. 

pae: SLY 2018 ) fh Mab 
Judge's signature 

Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 


City and state: Washington, D.C. 
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UNITED STATES DISTRICT COURT 


PORTEE DISS CADUTA & Sierk, U.S. Distria & Bankruptey 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF | 
INFORMATION ASSOCIATED WITH 
THE GOOGLE ACCOUNT 


Case: 1:18-sc~ -01518 

Assigned To : Howell, Beryl A. 
Assign. Date : 5/4/2018 

Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF AN 
APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, having been first duly sworn, hereby depose and state as follows: 

1. I make this affidavit in support of an application for a search warrant for 
information associated with the following Google Account: EE EEE 
the “Target Account 1”), that is stored at premises owned, maintained, controlled or operated by 
Google, Inc., a social networking company headquartered in Mountain View, California 
(“Google”). The information to be searched is described in the following paragraphs and in 
Attachments A and B. This affidavit is made in support of an application for a search warrant 
under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A) to require Google to disclose to 
the government copies of the information (including the content of communications) further 
described in Attachment A. Upon receipt of the information described in Attachment A, 
EEEE E, persons will review that information to locate the items described in 
Attachment B. 

2. Iam a Special Agent with the Federal Bureau of Investigation (FBI), and have 
been since 2011. As a Special Agent of the FBI, I have received training and experience in 
investigating criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 


experience, and information obtained from other agents and witnesses. This affidavit is intended 
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to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4, Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause 7 believe that the Target Accounts contain communications relevant to 
violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 
U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (making a 
false ARENO: 18 U.S.C. §1651 (perjury); 18 U.S.C. § 1030 (unauthorized access of a 
protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to 
commit wire fraud), , and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject 
Offenses”). ! 

5. As set forth below, in May 2016, Jerome CORSI provided contact information for 

o X Roger STONE. In July 2016, N.. told STONE that he 
needed to meet with then-candidate Trump “alone.” In August 2016, O= Q STONE 
that there was an “OCTOBER SURPRISE COMING” and that Trump, “[i]s going to be defeated 
unless we intervene. We have critical intel.” In that same time period, STONE communicated 
directly via Twitter with WikiLeaks, Julian ASSANGE, and Guccifer 2.0. On July 25, 2016, 
STONE emailed instructions to Jerome CORSI to “Get to Assange” in person at the Ecuadorian 
Embassy and “get pending WikiLeaks emails[.}”? On August 2, 2016, CORSI emailed STONE 
back that,“Word is friend in ais plans 2 more dipa One shortly after I'm back. 2nd in 


Oct. Impact planned to be very damaging.” On August 20, 2016, CORSI told STONE that they 


needed to meet with. ae: determine “what if anything Israel plans to do in Oct.” 


: Federal law prohibits a foreign national from making, directly or indirectly, an Spenaiture or independent 
expenditure in connection with federal elections. 52 U.S.C. § 30121(a)(1)(C); see also id. § 3010109) & a) 
(defining the terms “expenditure” and pnepenent expenditure”), 
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© Q Farget Account) is E Account, which 
O B to communicate with STONE and CORSI. 


JURISDICTION 


6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Zd. §§ 2703(a), (b)(L)(A), & (eX XA). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraph 8. . 
PROBABLE CAUSE 


A. USS. Intelligence Community (USIC) Assessment of Russian Government- 
Backed Hacking Activity during the 2016 Presidential Election 


7. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 
the Director of National Intelligence released a joint lemin of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following, with emphasis added: 

8. The U.S. Intelligence Community (USIC) is confident that the Russian 
Government directed the recent compromises of e mails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked e mails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are 
intended to interfere with the US election process. Such activity is not new to Moscow—the 


Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
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influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

9, On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: | 

10. [] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed 
at the US presidential election. Russia’s goals were to adenito public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential E EA We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

11. The USIC also described, at a high level, Sanne of the techniques that the Russian 
government employed during its interference. The USIC summarized the efforts as a “Russian 
messaging strategy that blends covert intelligence operations—such as cyber activity—with 
overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, 
and paid social media users or ‘trolls.’” 

12. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[iJn July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities to 
the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted in 


the compromise of the personal e-mail accounts of Democratic Party officials and political 
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figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” The GRU is the 
foreign military intelligence agency of the Russian Ministry of Defense, and is Russia’s largest 
foreign intelligence agency. 

13. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” - 

14. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

B. ` Roger Stone’s Public Interactions with Guccifer 2.0 and WikiLeaks. 

15. Roger Stone is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics since 1975. Stone worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until he was fired in August 2015. Although Stone had no 
official relationship with the Campaign thereafter, Stone maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. On August 
7,2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter account 
@RogerJStonejr., 

16. On June 14, 2016, news reports indicated that the computer systems of the DNC 
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC 
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June, 
21, 2016 release of hacked documents. 

17. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 


the DNC. 
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18. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” Stone wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” Stone embedded publicly available Tweets from Guccifer 2.0 in the article and 
wrote: ““Here’s Guccifer 2.0’s website. Have a look and you’ ll see he explains who he is and why 
he did the hack of the DNC.” Stone also stated: ““Guccifer 2.0 made a fateful and wise decision. 
He went to WikiLeaks with the DNC files and the rest is history. Now the world would see for 
themselves how the Democrats had rigged the game.” 

19. On August 8, 2016, Stone addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard to the 
- October surprise, what would be your forecast on that given what Julian Assange has intimated 
he’s going to do?” Stone hnit “Well, it could be a number of things. I actually have 
- communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 
served as an intermediary. 

20. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the piod cellphone 
numbers and email addresses from the files of the Democratic Congressional Campaign 


Committee (DCCC). 
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21. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 
2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
Twitter account was TT 

22, On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back,” Guccifer also sent a private message to @RogerJStonedr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleastine to me.” 

23. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 
Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy 
toward Ukraine. | 

24. On August 21, 2016, using @RogerJStoneJR, Stone directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same day, 


cee 


Stone reiterated that because of the work of a “‘mutual E AA of both his and [Assange], 

the public [could] expect to see much more from the exiled whistleblower in the form of 

PA E OEN Clinton email batches.” He added: “Well, first of all, I think Julian 

Alege is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 

believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 

intos aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 
25. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 


that he expected WikiLeaks to “drop a payload of new documents on a weekly basis fairly soon. 


And that of course will answer the question of exactly what was erased on that email server.” 
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26. On Saturday, October 1, 2016, using @RogerJStoneJr, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

27. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
feted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement — 
which was part of WikiLeaks’ 10-year anniversary celebration — Stone told Infowars that his 
intermediary described this release as the “mother load.” On Tuesday, October 4, 2016, Stone 
used @RogerJStoneJr to tweet: “Payload coming. #Lockthemup.” 

28. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood adi in 
which Mr. Trump had made a series of lewd remarks. | 

29. Approximately a half hour later, at 4:32 P.M., WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

30. WikiLeaks continued to release John Podesta’s hacked emails throughout October 
10-21, 2016. On October 12, 2016, John Podesta — referring back to Stone’s August 21, 2016 C- 
SPAN and Twitter reienenced - argued publicly that “[it is] a reasonable assumption to - or at 
least a reasonable conclusion - that [Stone] had advanced warning [of the release of his emails] 
and the Trump campaign had advanced warning about what Assange was going to do. I think 
there’s at least a reasonable belief that [Assange] may have passed this information on to 
[Stone].” Commenting to the Miami Herald, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 


know is through that channel of communications. I’m not implying I have any influence with 
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him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were . 
deleted. | hear that through my emissary.” 

31. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 


C. ~ Roger Stone’s Private Twitter Direct Messages with WikiLeaks and Julian 
Assange. 


32. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” — 


33. Less than an hour later, @wikileaks responded by direct message: “We appreciate 


that. However, the false claims of association are being used by the democrats to undermine the ` 


impact of our publications. Don't go there if you don't want us to correct you.” 
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34. — On October 16, 2016, @RogerJStoneJr sent a direct message to @wikileaks: “Ha! 
The more you \"correct\" me the more people think you're lying. Your operation leaks like a 
sieve. You need to figure out who your friends are.” 
35. | On November 9, 2016, one day after the presidential election, @wikileaks sent a 
_ direct message to @RogerJStoneJr containing a single word: “Happy?” @wikileaks immediately 
followed up with another message less than a minute later: “We are now more free to 
communicate.” 

36. In addition, @Roger! StoneJr also exchanged direct messages with Julian 
Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly 
messaged @JulianAssange, an address associated with Julian Assange in numerous public 
reports, stating: “Still nonsense. As a journalist it doesn't matter where you get information only 
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don't know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they're doing quite a lot. On the 

DoJ side that's coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

37. On Saturday, June 10, 2017, @Roger] StoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an tiie Must be circumspect in this 


forum as experience demonstrates it is monitored. Best regards R.” 
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Emails with Stone and Corsi 


39. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE KVI oOo O On October 


17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE’s BE QI 


po On March 14, 2018, Chief Judge Beryl A. Howell issued a search 


warrant for STONE’s iCloud account. On April 23, 2018, Chief Judge Beryl A. Howell signed 
an order pursuant to 18 U.S.C. §2703(d) for the Target Accounts. Information recovered 


pursuant to those search warrants and orders indicated the following: 


40. Onor about February 2 and February 3, 2016 — using Target 
Account I, sent two emails to ae. an email address associated wit i 
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41. | On or about February 5, 2016, a R two emails on Target 
Account | from an account associated vi i _ 
42. Onor about April 6, 2016, CORSI and [MMM on Target Account 1) 


exchanged seven emails. On or about April 7, CORSI email / ğ Target Account 


1. On or about April 8, 2016, = B CORSI. On or about April 10, 


O g CORSI exchanged two emails. On or about April 18, 2016, CORSI sent 


43. — Onor about May 1, 2016, CORSI emailed = @ Target Account 1) 


three times and . a him two responses. On or about May 2, 2017, aay 


(on Target Account 1) emailed CORSI. 


44, On or about May 17, 2016, STONE emailed Jerome CORSI, “send me G 


mail address.” CORSI wrote back, “Rogerf,] (Target 


Account 1) also seems to work as “4 
45. That same day, STONE emailed t Target Account 1. STONE 


wrote that he would have to move “our meeting to Wednesday. I am uncomfortable meeting 


without Jerry.” As described further below, it appears that “Jerry” is Jerome CORSI. STONE 


To QO additional emails about setting up dinner, and al 


emailed back, “RS{,] Confirming dinner Wednesday at 7PM at Club 21, JC included.” 


46. On or about that same day, May 17, oo Target Account 1, 


emailed CORSL 
47. On or about June 3, 2016, CORSI emailed o Target Account 1. 
E. Pe... and Corsi’s Text Messages about “October Surprise” and 
“Critical Intel.” 


are the same account. 


4 The ce in 1 a account is not read as a character. Therefore, onc 


12 


Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 18 of 35 


48. On or about May 17, 2016, essaged STONE, “Hi Roger, | hope 


all is well. Our dinner tonight for 7PM is confirmed. I arrive at 4PM. Please suggest a good 


restaurant that has privacy. Thank you. See you soon, PG STONE responded, 


‘See e-mail.” . 
49, On or about May 19, 2016, I ncssaged STONE, “Hi Roger, It Was 


Great Seeing You Again Last Night At Dinner. Did You Talk To Trump This Morning? Any 


News? Thank You. Best, el STONE responded, “Contact made — interrupted 


— mood good.” ae: STONE continued to text about arranging a meeting with 


then-candidate Trump. 


50. On or about-June 21, 2016, ES STONE, “RS: Secret | 


Cabinet Minister fii in NYC Sat. June 25. Available for DIT meeting. B According 


to publicly-availabe information, during this time =o }:: a Minister without 


portfolio in the O AE dealing with issues concerning defense and foreign affairs. 


51. On or about June 25, 2016, O QR Stone, “Roger, Minister left. 


Sends greetings from PM.° When am I meeting DJT? Should I stay or leave Sunday as planned? 


52; On or about June 26, 2016, STONE messaged fF F am better but 


turn out to have been poisoned. Completely out of action for 3 days-apologize to Minister for 
me. I would not leave as we hope to schedule the meeting mon or tues.” 
53. On or about June 28, 2016, | STONE, “RETURNING TO 


DC AFTER URGENT CONSULTATIONS WITH PM IN ROME.MUST MEET WITH YOU 


WED. EVE AND WITH DJ TRUMP THURSDAY IN ny i 
5 Based on O A here and below, I believe “PM” refers to the Ea Prime Minister. 


13 
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54. On or about Jun 29, 2016, STONE responded, “Monday meeting elapsed after 
DJT cleared his schedule to deal with the money crisis. I am waiting the new schedule. Will try 
for Thursday.” . 

55. On or about June 30, 2016, STONE messaged = RR — meeting 
now Ipm July 6.” i 

56. Onor about July 1, 2016, ‘rote back, “Thank you my friend . I 
will plan to be back in NYC on July 5" for the meeting with DJT on the 6" at lpm. THAY YOU 
ROGER,” STONE responded, “Sorry this took so long. R.” 

57. On July 5, 2016, | SS STONE, “Roger, I am here, ready for 
the meeting with DJ Trump at IPM tomorrow. Let’s you and I meet at 10.30AM at the St. Regis 
Lobby. Thank 

58. On July 6, 2016, | -- STONE, “At St Regis With Lt General. 
Waiting For You Thank You. o STONE wrote back, I i I am down 


with a nasty cold and too ill to travel- I have arranged for Jerri to take u in at 1 rather than lose ` 


the appointment — please connect with Jerri — Let me know how the meeting goes .DJT 
expecting u. R” Based on STONE’s contacts and emails described above, investigators believe 
that the “Jerri” referenced in the message refers to Jerome CORSI. 

59, ar wrote back, “Thank U Very Much[.] I Have To Meet Trump Alone 
After A Brief Introduction by Jerry Thanks Roger.” STONE wrote back, “As long as u get the 
meeting — I am very sorry I cannot attend — have a high fever and no voice.” o 


Zale 


60. On July 8, 2018 essaged STONE, “Hi Roger. Have you 


rescheduled the meeting with DJT? The PM is putting pressure for a quick decision. Thank you 


for all your help! == 
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6l. On or about July 8, 2016, STONE wrote back, “T not in NYC again before the 
convention. I have pneumonia and may be hospitalized later today. Í can get this back on track 
post convention when I can attend. Sorry about the fiasco’ last week, however you can’t just bring 
the General without tell me — R.” | 

62. On or about July 25, 2016, STONE sent an email from his ON to 
Jerome CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to 
Assange [a]t Ecuadorian Embassy in London and get pending WikiLeaks emails.. .they deal with 
Foundation, allegedly.” , i 

63. On or about July 29, 2016, ae... a messaged to STONE, “HI 
ROGER, I HOPE YOU ARE WELL. HAVE YOU SET UP A NEW MEETING WITH 
TRUMP? I PLAN TO BE BACK IN THE US NEXT WEEK. PLEASE ADVISE. THANK 


64. On or about July 31, 2016, STONE emailed CORSI with the subject line, “Call 


me MON.” The body of the email read: PE spouse see Assange[.] BE «oui find 
Bernie [S]Janders brother who called Bill a Rapist — turn him for Trumpf.] = should find 


ae more proof of Bill getting kicked out.” . 

65. On or about August 2, 2016 (approximately .19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed the STONE, “Word is friend in 
embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact planned to be very 
damaging . . -Time to let more than Podesta to be exposed as in bed w enemy if they are not 
ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start 
suggesting HRC old, ne bad, has stroke -- neither he nor she well. I expect that much of 


next dump focus, setting stage for Foundation debacle.” Investigators believe that CORSI’s 
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reference to a “friend in embassy [who] plans 2 more dumps” refers to Julian ASSANGE, the 
founder of WikiLeaks, who resided in Ecuador’s London Embassy in 2016. 


66.  Onor about August 9, 20 6, IE B STONE, “Roger-As per PM 


we have one last shot before moving on. Can you deliver? History will not forgive us. TRUMP 


IN FREE FALL. OCTOBER SURPRISE COMING Po 

67. On or about August 12, 2016, o RZ STONE, “Roger, hello 
from Jerusalem. Any progress? He is going to be defeated unless we intervene, We have critical 
intell. The key is in your hands! Back in the US next week. How is your Pneumonia? Thank you. 


Ll STONE replied, “I am well. Matters complicated. Pondering. R.” O 


back, “Thank You.” No additional messages appear in STONE’s iCloud between STONE and 


| K October 30, 2016. 


68. As described above, on October 7, 2016, WikiLeaks began releasing the emails 


hacked from John Podesta’s account. 


69. On October 26, 2016, | ws So n the Target 
Account. On or about October 27, 2016, S—s7] emailed hree 


times on the Target Account. 


70. On October 30, 2016, | STONE: “Roger, you are doing a 


great job !!! I am in NY-met with DJT and helping. Victory is in sight. HK says hello. Thanks, 


71. On Thursday, November 3, 2016, | STONE: “Roger, 


European country ready to release secret tapes to DESTROY objective. Can we meet ASAP? 4 


star General will join, as > ae STONE responded, “Yes let’s talk 
thurs.” ote back, “Must meet in NYC Thursday AM.” 
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72: On or about November 7, a cssaged STONE, 


“ROGER,JERRY- SORRY, BUT DUE TO AN UNEXPECTED EMERGENCY I HAVE TO 
CANCEL TODAY’S MEETING AT 9. THANKS a. . HAVING a TIA. Early Stroke.” 
STONE responded, “Take care of yourself.” rote back, “Tnaks Xou RGer. Blury 
Virson.” STONE replied, “You can’t die until after we elect Donald.” 

F. Stone’s HPSCI Testimony and Subsequent Conversations 

73. According to publicly-available reporting, Stone testified before the House 
Permanent Select Intelligence Committee (HPSCI) on September 26, 2017. STONE released his 
- prepared remarks to the media. In his remarks, Stone stated that he had learned Assange was in 
possession of the DNC Smail via Twitter, and that he asked a “journalist” to “independently 
confirm this report.” Stone stated his “intermediary” had “assured me that WikiLeaks would ` 
release this information in October and continued to assure me of this throughout the balance of 
August and all of September.” Stone denied knowledge in advarice of Podesta’s emails being 
hacked. Accordingly to publicly-available news reports, Stone subsequently informed HPSCI 
that his. intermediary was Randy Credico, an American radio host. | 

74. On or about November 24, 2017, Credico texted Stone, “I told you to watch his 
Tweets in October not before that I knew nothing about the DNC stuff. I just followed his 
Tweets.” Stone responded, “U never said anything about the DNC but it was August.” Credico 
replied, “It was not August because I didn’t interview him sf meet him until August 26°.” 

75.  Credico and Stone continued to exchange messages, and on December 1, 2017, 
Credico wrote: “I don’t know why you had to lie and say you had a ‘eek Channel now I had to 
give all of my forensic evidence to the FBI today what a headache. You could have just told him 


the truth that you didn’t have a back channel they now know that I was not in London until 
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September of this year. You had no back-channel and you could have just told the truth. You 
want me to cover you for perjury now.”® Stone responded, “What the fuck is your problem? 
Neither of us has done anything wrong or illegal. You got the best press of your life and you can 
get away with asserting for 5th amendment rights if u don’t want talk about[.] And if you turned 
over anything to the FBI you’re a fool.” Credico replied, “You open yourself up to six counts of 
pasty: But [’m sure that wasn’t sworn testimony so you’re probably clear... You should go 
back in a minute your testimony and tell them the truth ... You need to amend your testimony 
before I testify on the 15.” Stone wrote, “If you testify you’re a fool. Because of tromp [sic] I 
could never get away with a-certain [sic] my Fifth Amendment rights but you can. I sae 
you vat are the one who gets indicted for perjury if you’re stupid enough to testify.” Stone and 
Credico continued to correspond, and according to publicly available news reports, on December 
13; 2017, Credico asserted his Fifth Amendment right not to testify before the HPSCI. 

76. On January 25, 2018, Credico texted Stone, “You lied to the house Intel 
committee. But you’ ll get off because you're friends with Trump so don’t worry. I have all the 
forensic evidence. I was not a ba[ck] Channel and [ have all those emails from September of 
2016 to prove it.” 

INFORMATION REGARDING GOOGLE 

77, Google provides numerous free services to the users with a Google profile. Some 
of services include, Gmail, Goole Talk, Google Wallet, Google+, Google Drive, Google+ 
Photos, and YouTube. Gmail is a web based email service. Google Talk is an instant messaging 
service that provides both text and voice communication. Google Talk conversation logs are 
saved to a “Chats” area in the user’s Gmail account. Google+ is a social networking service. 
Google Drive is a file storage and synchronization service which provides users with cloud 


é Contrary to his statement, Credico had not provided any information to the FBI. 
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storage, file sharing, and collaborative editing. Google+ Photos (formerly knowns as Picasa Web 
Albums) is an image hosting and sharing web service that allows users with a Google account to 
store and share images for free. YouTube is a free video sharing website that allows users 
upload, view and share videos. Google also retains a record of searches conducted by the user, as 
well as location data for the use of some of the services described above. All of these services 
may record information uploaded, inputted, or gathered from the user. 

CONCLUSION 


78. Based on the forgoing, I request that the Court issue the proposed search warrant. 
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REQUEST FOR SEALING 


79. I further request that the Court order that all papers in support of this application, 
including the application, affidavit and search warrant, be sealed until further order of the Court. 
These documents discuss an ongoing criminal investigation that is neither public nor known to 
all of the targets of the investigation. Accordingly, there is good cause to seal these documents 
because their premature disclosure may give targets an opportunity to flee/continue flight from 
prosecution, destroy or tamper with evidence, change patterns of behavior, notify confederates, 


or otherwise seriously jeopardize the investigation. 


Affdrew T. Mitchell 
Special Agent 
_ Federal Bureau of Investigation - 


Subscribed and sworn to before me on this 7 day of May, 2018. 


The Honorable Beryl A. Howell 


Chief United States District Judge 
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ATTACHMENT A 
Property to Be Searched 
This warrant applies to information associated with the Google account 
ae is stored at premises owned, maintained, controlled, or operated 
by Google, Inc., a business with offices located at 1600 Amphitheatre Parkway, piema View, 


CA 94043. 
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ATTACHMENT B 


ATTACHMENT B 
Particular Things to be Seized $ 


I. Files and Accounts to be produced by Google, Inc. between January 1,2016 and 
the Present. 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment A: 


a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and destination 
e-mails sent addresses associated with each e-mail, the date and time at which each e-mail was 
sent, and the size and length of each e-mail; 1 


b. All existing printouts from original storage of all of the electronic mail described 
above in Section L.A. above; 


c. All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above in 
Section LA, including log files, dates, times, methods of connecting, ports, dial ups, and/or 
locations; 


e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 


f. All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, telephone 
numbers and other identifiers, records of session times and durations, the date on which the 
account was created, the length of service, the types of service utilized, the IP address used to 
register the account, log-in IP addresses associated with session times and dates, account status, 
alternative e-mail addresses provided during registration, all screen names associated with 
subscribers and/or accounts, all account names associated with the subscriber, methods of 
connecting, log files, means and source of payment (including any credit or bank account 
number), and detailed billing records; 


g. All records indicating the services available to subscribers of the electronic mail 


address described above in Section LA.; 
h. Google+ subscriber information, circle information, including name of circle and 


1 This Search warrant applies on to email sent, received, or drafted on or after May 26, 2017. 
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members, contents of posts, comments, and photos, to include date and timestamp; 


iF Google Drive files created, accessed or owned by the account; 


i YouTube subscriber information, private videos and files, private messages, and 
comments; 
k. Google+ Photos contents to include all images, videos and other files, and 


associated upload/download date and timestamp; 


l. Google Talk and Google Hangouts conversation logs associated with the account. 


H. 
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Information to be Seized by Law Enforcement Personnel 


a. Any and all records that relate in any way to the account described in Attachment 
A which is evidence, fruits, and instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (making a false statement); 18 U.S.C. §1651 
(perjury); 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 
(wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), , and 52 U.S.C. 


§ 30121 (foreign contribution ban) from Jan 1, 2015 to the present, including: 


All records, information, documents or tangible materials that relate in any way to 
communications with foreign government officials or agents of a foreign power, 
or discussions with others regarding those actions, or plans or attempts at 
undertaking such actions: l 


b. All images, messages, communications, calendar entries, search terms, and 
contacts, including any and all preparatory steps taken in furtherance of these crimes; 


c. Communication, information, documentation and records relating to who created, 
used, or communicated with the account or identifier, including records about their identities and 
whereabouts; ; 


d. Evidence of the times the account was used; 


e. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 


f. Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 


g. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


h. All existing printouts from original storage which concern the categories 
identified in subsection H.A; and 


i. All “address books” or other lists of contacts. 
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UNITED STATES DISTRICT. COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS 
AND TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(B 


Case: 1:18-sc-01518 

Assigned To : Howell, Beryl A. 

Assign. Date : 5/4/2018 

Description: Search & Seizure Warrant 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to non-disclosure, 
the proposed Order would direct Google LLC, an electronic communication and/or remote 
computing services provider with headquarters in Mountain View, California, not to notify any 
other person (except attorneys for Google for the purpose of receiving legal advice) of the 
existence or content of the Warrant for a period of one year unless otherwise ordered of the Court. 


. JURISDICTION AND LEGAL BACKGROUND 


l. The Court has the inherent power to seal court filings when appina, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 


court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 


Page | of 6 


Case 1:19-mc-00029-CRC Document 29-7 Filed 04/28/20 Page 31 of 35 


“district court of the United States . . . that — has jurisdiction over the offense being investigated.” 
18 U.S.C. § 2711(3)(A)Q@). As discussed fully below, acts or omissions in furtherance of the offense 
under investigation occurred within Washington, D.C. See 18 U.S.C. § 3237. Ps 
SSE SSeS 
s 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Google provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Google ase be 
compelled to supply communications and other RT using a subpoena, cae order, o search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a dubpacha. Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(1)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4, The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 
notification. In relevant part, Section 2705(b) provides as follows:! 

(b) Preclusion of notice to subject of governmental access. — A governmental 

entity acting under section 2703 . . . may apply to a court for an order commanding 


a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 


' Section 2705(b) contains additional requirements for legal process obtained pursuant to 
18 U.S.C. § 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any 
legal process under that provision. 
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` deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will resuit in — 


(1) endangering the life or physical safety ofan individual; 
(2) flight from prosecution; 
(3) destrien of or tampering with evidence; 

: (4) intimidation of potential witnesses; or 


(5) otherwise seriously jeopardizing an investigation or unduly delaying 
a trial. 


18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 
requisite showing about potential consequences of notification: 
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 


government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 


In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. $ 2705(b) for Grand Jury 
Subpoena #GJ201403 1422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Goole not to notify any other person (except attorneys for Google for the purpose of 
receiving legal advice) of the existence of the Warrant for a period of one year unless otherwise 
ordered by the Court. 


FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. At the present time, law enforcement officers of the FBI are conducting an 


investigation into violations related to 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory 
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. after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. 
§ 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. 
§ 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign 
contribution ban) arising out of the conduct of various unknown persons that operated and 
controlled the subject accounts. It does not appear that these individuals are currently aware of the 
nature and scope of the ongoing FBI investigation. 

REQUEST FOR SEALING AND NON-DISCLOSURE 

7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Google and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal 
advice) for a period of one year unless otherwise ordered by the Court. Such an order is appropriate 
because the Warrant relates to an ongoing criminal investigation, the full scope of which is neither 
public nor known to the targets of the investigation, and its disclosure may alert these targets to 
the ongoing investigation and its scope. Once alerted to this investigation, potential targets would 
be immediately prompted to destroy or conceal incriminating evidence, alter their operational 
tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid 
future prosecution. In particular, given that they are known to use electronic communication and 
remote computing services, the potential target could quickly and easily destroy or encrypt digital 
evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 


confidential investigation will continue for the next year or longer, However, should circumstances 
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change such that court-ordered nondisclosure under Section 2705(b) becomes no longer needed, 
the Government will notify the Court and seek appropriate relief. 

9, There is, therefore, reason to believe that notification of the existence of the Warrant 
will seriously jeopardize the investigation, including by giving the targets an opportunity to flee 
from prosecution, destroy or tamper with evidence, ia intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)H{(5). Because of such potential jeopardy to the investigation, ‘iets also exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Google, the United States is aware that, absent a court 
order under Section 2705(b) commanding Google not to notify anyone about a legal request, it is 
Google’s policy and practice, upon receipt of a warrant seeking the contents of Jerona 
stored wire or electronic communications for a certain account, to notify the subscriber or customer 
of the existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 


Google not to notify any other person of the existence or contents of the above-captioned warrant 
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(except attorneys for Google for the purpose of receiving legal advice) for a period of one year 


unless otherwise ordered by the Court. 


Respectfully submitted, 


ROBERT S. MUELLER, HI 


Special Counsel a 
Dated: Or 4 By yE 
Kyle Freeny 


Special Counsel’s 
Office (202) 616-0800 
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AO 106 (Rey. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Massachusetts 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


Case No. WI- 4 = moe 
The Person (iii ` |$- á 


wnr anaa ESE’ 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 


located in the District of Massachusetts , there is now concealed (identify the 


person or describe the property to be seized): 


See Attachment B. 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
© evidence of a crime; 
© contraband, fruits of crime, or other items illegally possessed; 
M property designed for use, intended for use, or used in committing a crime; 


O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. §§ 2, 3, 4, 371, Aiding & Abetting (§ 2); Accessory after the Fact (§ 3); Misprison of a Felony (§ 4); 
1030, 1343 and 1349 Conspiracy (§ 371); Computer Fraud (§ 1030); Wire Fraud (§ 1343); Attempt and 


Conspiracy to Commit Wire Fraud (§ 1349). 
The application is based on these facts: 


See attached Affidavit. 


wo Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Applicant's signature 


/ Curtis Heide, Special Agent, FBI 


ff Printed name and. title 


Í 


i 


Sworn to before me and signed in my presence. 


Date: 03/27/2018 _Mamcnume D: 


PUTAS A A g 
{ Judge's Signy ure 


City and state: Boston, Massachusetts United States Magistrate Judge Marianne B. Bowler 
Printed name and title 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT 


for the 


District of Massachusetts 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


APPLICATION FOR A SEARCH WARRANT 


Case No. [1S -WS = 2193-4 asp 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 


located in the District of Massachusetts , there is now concealed (identify the 
person or describe the property to be seized): 


See Attachment B. 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
Mf evidence of a crime; 
om contraband, fruits of crime, or other items illegally possessed; 
MÍ property designed for use, intended for use, or used in committing a crime; 


O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. §§ 2, 3, 4, 371, Aiding & Abetting 6 2); Accessory after the Fact (§ 3); Misprison of a Felony (§ 4); 
1030, 1343 and 1349 Conspiracy (§ 371); Computer Fraud (§ 1030); Wire Fraud (§ 1343); Attempt and 


Conspiracy to Commit Wire Fraud (§ 1349). 
The application is based on these facts: 
See attached Affidavit. 


mM Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


p RA s signature 


Cu bide Speċial Agent, FBI 


SA Printed name and title 


Sworn to before me and signed in my presence. 


Date: 03/27/2018 


City and state: Boston, Massachusetts United States O ar € Marianne B. Bowler 
Printed namié and title 
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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF MASSACHUSETTS 


IN THE MATTER OF THE SEARCH OF 
THE PERSON OF 


Case No. | F -O —2 ITA-M RR 


Filed Under Seal 


IN THE MATTER OF THE SEARCH OF Case No. 


Ie =a 
THE BAGGAGE OF RIID -MBB 


Filed Under Seal 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR SEARCH WARRANTS 


I, Curtis Heide, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for search and seizure warrants 
under Rule 41 of the Federal Rules of Criminal Procedure authorizing the search of the person of 
A (the Target Person) (described further in that warrant’s 
Attachment A), and any baggage associated with him (described further in that warrant’s 
Attachment A), and the seizure of the electronic devices and media described in Attachment B 
(the Target Devices). I anticipate this search will be executed after E at Logan 
International Airport at approximately D This warrant is for the 
seizure of the devices only; the Government will seek a warrant to search any seized devices at a 
later point in time. 

2. I, Curtis A. Heide, have been a Special Agent with the Federal Bureau of 
investigation for 11 years. In the course of my duties, I have been responsible for investigating 
federal crimes and national security matters involving both counterintelligence and issues related 


to cybersecurity. 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4, Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that ROGER STONE, JEROME CORSI and others have 
committed violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the 
fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), and 18 U.S.C. 

§ 1349 (attempt and conspiracy to commit wire fraud) (the “Subject Offenses”). 
JURISDICTION 

3: This Court has jurisdiction to issue the requested warrant because, as described 
further below, it is anticipated nat and his baggage will be located in the District of 
Massachusetts on o 

SUMMARY 


6. As set forth below, (the Target Person) was in contact with Roger 


STONE and Jerome CORSI during the summer and fall of 2016, when STONE appears to have 
obtained advance knowledge of the release by WikiLeaks of illegally hacked emails for the 
benefit of the presidential campaign of Donald J. Trump (the “Campaign’’). In July 2016, 


STONE instructed CORSI to have talk with Julian ASSANGE, the founder of 


WikiLeaks, and ae... as CORSI’s conduit to ASSANGE to discuss hacked 


information. 
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7. More specifically, on or about July 25, 2016, STONE emailed CORSI to “Get to 
Assange” in person at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]’ On or 
about July 31, 2016, STONE instructed CORSI to T E ASSANGE.” At the 
ine i lived in London, where Assange was located at the Ecuadorian Embassy. On 
or about August 2, 2016, CORSI told STONE that the “word is friend in embassy [ASSANGE] 
plans 2 more dumps. One shortly after I’m back. 2nd in October. Impact planned to be very 
damaging.... Time to let Podesta to be exposed as in bed w enemy if they are not ready to drop 
HRC.” Information disclosures subsequently occurred on or about the times CORSI predicted. 

8. On or about August 10, 206 began emailing CORSI multiple news 
articles regarding ASSANGE and alleged Russian involvement in the election. On or about 
November 13, 2016, — emailed STONE to congratulate him on “tak[ing] the country 


back,” and stating, “You deserve a lot of credit and working with you and Jeri Corsi, who is with 


me now in London has been a great joy.” On or about January 7, 2017 ON 
STONE and CORSI to joke about John Podesta going “phishing.” As stated below, I know from 
my training and experience that the term “phishing” is used to refer to the practice of sending 
emails purporting to be from a reputable party in order to trick individuals to reveal to the sender 
personal information, including passwords. 
PROBABLE CAUSE TO BELIEVE THAT A FEDERAL CRIME WAS COMMITTED 
A. Background on Relevant Individuals 
i. Roger STONE 
9. Roger STONE is a self-employed political strategist/consultant and has been 

actively involved in U.S. politics for decades. STONE worked on the Campaign until August 


2015. Although STONE had no official relationship with the Campaign thereafter, STONE 
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maintained his support for Trump and continued to make media appearances in support of the 
Campaign. As described further below, STONE also maintained contact with individuals 
employed by the Campaign, including then-campaign chairman Paul MANAFORT and deputy 
chairman Rick GATES. 
ii. Jerome CORSI 

10. Jerome CORSI is a political commentator who, according to publicly-available 
information, serves as the “Washington Bureau Chief for Infowars.com.” According to publicly- 
available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” for the 
website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of books 
regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed 
Hacking Activity during the 2016 Presidential Election 


12. On October 7, 2016, the U.S. Department of Homeland Security and Office of the 
Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election.! In the report, the USIC 
assessed the following: 

13. “The U.S. Intelligence Community (USIC) is confident that the Russian 
Government directed the recent compromises of e-mails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked e-mails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are 
intended to interfere with the US election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities.” 

14. On January 6, 2017, the USIC released a declassified version of an intelligence 


assessment of Russian activities and intentions during the 2016 presidential election entitled, 


' “Joint Statement from the Department Of Homeland Security and Office of the Director of National Intelligence on 
Election Security,” Oct. 7, 2016, available at ttps://www.dhs.gov/news/2016/10/07/joint-statement-department- 
homeland-security-and-office-director-national. 
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“Assessing Russian Activities and Intentions in Recent US Elections.’” In the report, the USIC 
assessed the following: 

15.  “{] Russian President Vladimir Putin ordered an influence campaign in 2016 
aimed at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

16. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

17. With respect to hacking activity, the USIC assessed: “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” In addition, “In July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC further assessed that cyber 
operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU) 
“resulted in the compromise of the personal e-mail accounts of Democratic Party officials and 


political figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 


2 “Assessing Russian Activities and Intentions in Recent US Elections,” Jan. 6, 2017, available at 
https://www.dni.gov/files/documents/ICA_2017_01.pdf. 
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18. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

19. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his likely Russian identity throughout the 
election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted 
with journalists. 

C. Roger STONE?’s Disclosed Interactions with Guccifer 2.0 and WikiLeaks. 

20. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics since 1975. STONE worked on the Campaign until he was 
fired in August 2015. Although STONE had no official relationship with the Campaign 
thereafter, STONE maintained his support for Trump and continued to make media appearances 
in support of Trump’s presidential campaign. 

21. As discussed further below, STONE made a number of public references to 
WikiLeaks and its release of DNC-related emails. STONE has also stated that he was in contact 
via Twitter with Guccifer 2.0. 

22. On June 14, 2016, news reports indicated that the computer systems of the DNC 
had been hacked. On June 15, 2016, Guccifer 2.0 publicly claimed responsibility for the DNC 
hack. Shortly thereafter, Guccifer 2.0 began releasing the hacked documents, including a June 
21, 2016 release of hacked documents. 

23. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 


the DNC. 
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24. On August 5, 2016, Roger STONE published an article on Breitbart.com entitled, 
“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” STONE wrote: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” STONE embedded publicly available Tweets from Guccifer 2.0 in the article and 
wrote: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and why 
he did the hack of the DNC.” STONE also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

25. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With regard to 
the October surprise, what would be your forecast on that given what Julian Assange has 
intimated he’s going to do?” STONE responded: “Well, it could be a number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with Assange, he had a close 
friend who served as an intermediary. 

26. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJSTONESr thanks 
that u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal 
cellphone numbers and email addresses from the files of the Democratic Congressional 


Campaign Committee (DCCC). 
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Zak On August 13, 2016, STONE posted a tweet using @RogerJSTONESr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

28. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJSTONEJr paying 
you back.” Guccifer also sent a private message to @RogerJSTONEJr stating “i’m pleased to say 
ur great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

29. On August 18, 2016, Paul Manafort, STONE’s longtime friend and associate, 
resigned as Chairman of the Campaign. Contemporary press reports at the time indicated that 
Manafort had been working with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

30. On August 21, 2016, using @RogerJSTONEJR, STONE directed a tweet at John 
Podesta, Hillary Clinton’s presidential campaign manager, stating: “Trust me, it will soon the 
[sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same day, 
STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form 
of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

31. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on a weekly basis fairly 
soon. And that of course will answer the question of exactly what was erased on that email 


server.” 
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32. On Saturday, October 1, 2016, using @RogerJSTONEJr, STONE Tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

33. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement — 
which was part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his 
intermediary described this release as the “mother load.” On Tuesday, October 4, 2016, STONE 
used @RogerJSTONEJr to tweet: “Payload coming. #Lockthemup.” 

34. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

35. Approximately a half hour later, at 4:32 P.M., WikiLeaks send a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

36. WikiLeaks continued to release John Podesta’s hacked emails throughout October 
10-21, 2016. On October 12, 2016, John Podesta — referring back to STONE’s August 21, 2016 
C-SPAN and Twitter references — argued publicly that “it is] a reasonable assumption to - or at 
least a reasonable conclusion - that [STONE] had advanced warning [of the release of his emails] 
and the Trump campaign had advanced warning about what Assange was going to do. I think 
there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the Miami Herald, STONE responded: “I have never met or spoken 
with Assange, we have a mutual friend who’s traveled to London several times, and everything I 


know is through that channel of communications. I’m not implying I have any influence with 
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him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 
deleted. I hear that through my emissary.” 

37. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 


D. Roger STONE’s Private Twitter Direct Messages with WikiLeaks and Julian 
Assange. 


38. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJSTONESr. 

39. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, @RogerJSTONEJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 


strategy of attacking me- cordially R.” 
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40. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

41. On October 16, 2016, @RogerJSTONEJr sent a direct message to @wikileaks: 
“Ha! The more you \"correct\" me the more people think you're lying. Your operation leaks like 
a sieve. You need to figure out who your friends are.” 

42. On November 9, 2016, one day after the presidential election, @wikileaks sent a 
direct message to @RogerJSTONESJr containing a single word: “Happy?” @wikileaks 
immediately followed up with another message less than a minute later: “We are now more free 
to communicate.” 

43. In addition, @RogerJSTONEJr also exchanged direct messages with Julian 
Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJSTONESr directly 
messaged @JulianAssange, an address associated with Julian Assange in numerous public 
reports, stating: “Still nonsense. As a journalist it doesn't matter where you get information only 
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don't know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they're doing quite a lot. On the 
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to 


squeeze us into a deal.” 
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44, On Saturday, June 10, 2017, @RogerJSTONEJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 


forum as experience demonstrates it is monitored. Best regards R.” 


E. Roger STONE’s Emails with Jerome CORSI and = RR Assange 
and WikiLeaks 


45. On or about September 11, 2017, Chief Judge Beryl A. Howell of the District of 


Columbia issued a search warrant for STONE i address [il On 


or about October 17, 2017 Chief Judge Howell issued a warrant for STONE’ sfiadaress, 


On or about December 12, 2017, Chief Judge Howell issued a warrant 


mail address i Emails recovered pursuant to that 


search warrant indicated the following: 


for 


46. Onor about May 23, 201 ao A STONE with the subject, 
“Trump Campaign,” to offer his assistance to the Campaign RE vote that he was “on 
to the notorious Oxford case already!” He also stated that he was “available, literally, as needed, 
to contribute in ways the campaign sees fit. I’d like to go to Cleveland and pitch in, raise money 
and work for you. Can you use me?” Cleveland, Ohio was the location of the 2016 Republican 
National Convention, held July 18-21, 2016. 

47. On or about June 4, 2016, STONE emailed I ring him to “Plan on 
going to Cleveland. Will need your help. Can handle credentials.” 

48.  Onor about June 20, 2016 TT emaitea STONE and MANFORT, asking 
to “know immediately how I can help” the Campaign. oy also wrote that his “research 


- on Rhodes House” was nearing completion. Rhodes House is the headquarters of the Rhodes 
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Trust, which provides scholarships to Oxford University, and the “Rhodes House” research 

appears to be a reference to STONE’s previous tweet on or about October 13, 2015 that, “In 

1969, Bill Clinton was expelled from Oxford for raping nineteen-year-old fii nn.” 

STONE mentioned Wellstone again g o o a month later, as discussed below. The 

“Rhodes House” research seems to be the same as the “notorious Oxford case” referenced by 
E above. 

49, On or about July 7, -oo emailed STONE that he had “my tickets to 
Cleveland[.] [D]o you have my credential pack?” 

50. On or about July 25, 2016, (approximately three days after WikiLeaks began 
releasing emails hacked from the no iii a commentator who had publicly accused 
the Clinton Foundation of fraud, emailed STONE with the subject line, “You need to get to 
Assange.” The body of the message read: “At Ecuadorian Embassy in London and get the 
pending wikileaks emails...they deal with Foundation, allegedly.” 

51. According QG approximately ninety 
minutes later STONE called CORSI and they spoke for 26 minutes. 

52, Less than two hours after the phone call to CORSI, STONE emailed CORSI with 
the subject line, “Get to Assange.” The body of the message read: “Get to Assange [a]t 
Ecuadorian Embassy in London and get pending WikiLeaks emails. ..they deal with Foundation, 
allegedly.” It appears that STONE cut and pasted the email from Ortel to CORSI. 

53. On or about July 27, 2016, then-candidate Donald Trump stated in a press 
conference, “Russia, if you are listening, I hope you’re able to find the 30,000 [Hillary Clinton] 
emails that are missing. I think you will probably be rewarded mightily by our press. Let’s see if 


that happens. That will be next.” 
14 
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54. Onor about July 28, 2016, Roger STONE called Richard GATES (then the 
deputy-chair of the Campaign). They spoke for approximately twelve minutes. 

55. Onor about July 30, 2016, Paul MANAFORT (then the Chairman of the 
Campaign) called STONE. They spoke for approximately one hour and seven minutes. The 
Government has analyzed toll records from January 1, 2016 to November 9, 2016. Sixty-seven 
minutes is the longest call (by almost a half-hour) that took place between STONE and 
MANAFORT in this time period. 

56. On or about July 31, 2016, STONE emailed CORSI with the subject line, “Call 
me MON.” The body of the email read: ‘B should see Assange[.] J should find 
Bernie sanders brother who called Bill a Rapist — turn him for Trump[.] [J should find 
GE ©« more proof of Bill getting kicked out.” 

57. On or about August 2, 2016, CORSI emailed STONE: “With family, 25" 
wedding anniversary Aug 9. Return Home Aug 12. Word is friend in embassy plans 2 more 
dumps. One shortly after I’m back. 2nd in Oct. Impact planned to be very damaging . . .Time to 
let more than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That 
appears to be the game hackers are now about. Would not hurt to start suggesting HRC old, 
memory bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting 
stage for Foundation debacle.” Based on my training, experience, and review of materials in this 
case, it appears that CORSI’s reference to a “friend in embassy [who] plans 2 more dumps” 
refers to ASSANGE, the founder of WikiLeaks, who resided in Ecuador’s London Embassy in 
2016. On or about August 12, 2016, Guccifer publicly released information hacked from the 


DCCC (the date CORSI identified as when he would “return home.”’). 
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58. On or about August 10, 2016, 


mailed CORSI an article titled, 
“Assange Warns of ‘Triangle of Terror’- Clinton, Pentagon & Google.” 


59. On or about August 13, 2016, emailed CORSI a news article titled, 


“Assange Implies Murdered DNC Staffer Was WikiLeaks’ Source.” 


60. On or about August 16, 2016, emailed CORSI an email with the 


subject line, “Vladimir Putin Has Already Won Our Election.” The body of Oo email 
contained two words: the word “VENONA” and the word “Observer.” According to publicly 
available information, the “Venona Project” was a top-secret U.S. intelligence effort to gather 
and decrypt messages sent in the 1940s by Soviet military intelligence. On or about August 13, 
2016, the Observer had published an article titled, “Vladimir Putin Has Already Won Our 
Election” (the subject of the email). The subtitle of the article stated: “It’s time to face facts: 
Kremlin spies and hackers are undermining American politics.” The article further discussed 
how, “WikiLeaks, nowadays a transparent Kremlin front, disseminated some 20,000 purloined 
DNC emails that were stolen by Russian intelligence.” The article also stated that the “Kremlin is 
weaponizing stolen information for political effect.” 

6l. On or about August 30, 2016, O Steve Bannon, who had 
become chief executive of the Campaign when MANAFORT left the Campaign on or about 
August 19, 2016, with STONE and CORSI ce’d. E offering his assistance and 
stating he had been “labouring non stop for the Trump campaign — even tho[u]gh I am all the 
way over here in Oxford. . . . I have been in constant touch with the campaign, Roger Stone and 
Jeri Corsi.” 


62. On or about October 7, 2016, WikiLeaks began releasing the Podesta emails. 
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63.  Onor about November 13, 2016, aE GR ston: 


wrote, “Well, we did it and now have an opportunity of a lifetime to take the country back. God 
is good and we are well placed to steer things well. You deserve a lot of credit and working with 
you and Jeri Corsi, who is with me now in London has been a great joy.” 


64. On or about January 7, 2017, an individual named E emailed 


STONE, CORSI, sn with the subject line, “in case you need his mail......... Fi 


Attached to the message was a scan of a business card for John Podesta. Several hours later, 
a “Ha... maybe he wants to go phishing with us?” 

65. I know from my training and experience that the term “phishing” is used to refer 
to the practice of sending emails purporting to be from a reputable party in order to trick 
individuals to reveal to the sender personal information, including passwords. Public reports 
indicate that Podesta’s emails were obtaining through a “phishing” scheme. 


F. | Email Account 


66. In addition to his Gmail account also uses a U.K.-based email 


des o Investigators found emails with this address Li 


Gmail account. The U.K. email address was also listed in messages sent as a means 


of reaching him. A publicly-available database lists the U.K. email address as belonging to 
P| The U.K. email address is housed outside the United States, and investigators 
anticipate it may take substantial time to retrieve the messages on the account via a potential 
treaty request. In addition, it is possible that emails may have been deleted or no longer 
maintained. I know from my training and experienced that users often download and store emails 
on their phones, tablets, and laptops, such as the Target Devices. Even if information has been 


deleted by the user, the Government may be able to employ forensic tools to recover information 
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from his devices. In addition, as described further below, the Target Devices may include a 
variety of other stored communications, including voicemail, text message, and other third party 
messaging systems which have used to communicate with CORSI, STONE, 
and others regarding WikiLeaks. 


THE PERSON AND BAGGAGE TO BE SEARCHED CONTAIN EVIDENCE, FRUITS 
AND INSTRUMENTALITIES 


67. I also have probable cause to believe that the person and baggage to be searched 


contains fruits, evidence, and instrumentalities of violations of the federal statutes listed above, 


as described in the warrants’ respective Attachments A and B. 


68. Records indicate no has purchased a ticket iii 


I know from my training and experience that individuals often carry electronic devices and 
storage media of the type described in Attachment B with them when they travel both on their 
persons and in their baggage. These devices and media include but are not limited to cellular 
phones, tablets, laptops, thumb drives, CDs, DVDs, and external hard drives. 

69. From my training and experience, I am also aware that personal computer systems 
are generally capable of creating, receiving, and otherwise processing computer files such as e- 
mail, word-processing documents, photographs, and spreadsheets. As evidenced by the emails 
above TE ses computer systems to communicate with CORSI and STONE regarding 
WikiLeaks. 

70. Based on my training, experience, and information provided by other law 
enforcement officers, I know that many smartphones (which are included in Attachment B) can 


now function essentially as small computers. Smartphones have capabilities that include serving 
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as a wireless telephone, digital camera, portable media player, GPS navigation device, sending 
and receiving text messages and e-mails, and storing a vast range and amount of electronic data. 
Examining data stored on devices of this type can uncover, among other things, evidence that 
reveals or suggests who possessed or used the device. 

71. Based on my knowledge, training, experience, and information provided to me by 
other agents, I know that computer files or remnants of such files can be recovered months or 
years after they have been written, downloaded, saved, deleted, or viewed locally or over the 


Internet. This is true because: 


e Electronic files that have been downloaded to a storage medium can be stored for 
years at little or no cost. Furthermore, when users replace their computers, they 


can easily transfer the data from their old computer to their new computer. 


e Even after files have been deleted, they can be recovered months or years later 
using forensic tools. This is so because when a person “deletes” a file on a 
computer, the data contained in the file does not actually disappear; rather, that 
data remains on the storage medium until it is overwritten by new data, which 
might not occur for long periods of time. In addition, a computer's operating 


system may also keep a record of deleted data in a “swap” or “recovery” file. 


e Wholly apart from user-generated files, computer storage media, in particular, 
computers’ internal hard drives, contain electronic evidence of how the computer 
has been used, what it has been used for, and who has used it. This evidence can 
take the form of operating system configurations, artifacts from operating system 


or application operation, file system data structures, and virtual memory “swap” 
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or paging files. It is technically possible to delete this information, but computer 
users typically do not erase or delete this evidence because special software is 


typically required for that task. 


e Similarly, files that have been viewed over the Internet are sometimes 
automatically downloaded into a temporary Internet directory or “cache.” The 
browser often maintains a fixed amount of hard drive space devoted to these files, 
and the files are overwritten only as they are replaced with more recently viewed 


Internet pages or if a user takes steps to delete them. 
CONCLUSION 


72. Based on the forgoing, there is probable cause to believe that one or more people 
have violated the statutes specified above and that electronic devices and media containing 
evidence, fruits, and instrumentalities of those crimes, are contained on the person of 

| QR further in that warrant’s Attachment A) and his baggage (described 
further in that warrant’s Attachment A), and for the seizure of the electronic devices and media 
described in further in Attachment B. 


REQUEST FOR AUTHORIZATION TO EXECUTE THE WARRANTS BEFORE 
6 AM OR AFTER 10 PM 


13. In addition, I request that the search warrants authorize searches and seizures 


before 6 AM and after 10 PM. co fen is scheduled to land + 


een I am aware that flight departure and arrival times can vary widely from those announced 


because of adverse weather or other delays throughout the airline transportation system. If 


because of a flight delay | a landed at 10:01 PM, a warrant without the 
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requested authorization could not be executed for another 8 hours, requiring me to either obtain a 
new warrant or to m g his baggage until 6 AM the next morning. The 
requested authorization will allow the searches and seizures to progress as efficiently as possible, 
with minimal delay D g any other person with whom he is travelling. 


REQUEST FOR SEALING 


74. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Sworn to under the pains and penalties of perjury, 


a - P ai- A 


Curtis Heide 
Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this 27th day of March 2018. 


Marianne B. Bowler: | 
United States Magistrate Judge”; j 


O ; Sf 


NK i, . J 
N + i 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 


In the Matter of the Search of 02401 | 
(Briefly describe the property to be searched Case: 1:18-sc A 
or identify the person by name and address) Assigned To: Howell, Beryl . i 


INFORMATION ASSOCIATED WITH = Assign. Date : 7/12/2018- | 
Description: Search & Seizure Warrant 


SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern Districtof ss s§_—S—sCailifornia 


(identify the person or describe the property to be searched and give its location): 


See Attachment C. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment D. 


YOU ARE COMMANDED to execute this warrant on or before July 26, 2018 __ (not to exceed 14 days) © 
A inthe daytime 6:00 a.m. to 10:00 p.m. O at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 


person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to __ Hon. Beryl A. Howell 
(United States Magistrate Judge) 


©) Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 


for days (not to exceed 30) 1 until, the facts justifying, the later specific date of 


Date and time issued: 2 TA ZY. a ia s7 A 7) Ve poas 


Judge `s signature 


City and state: Washington, DC Hon. Bery! A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. . i 


Executing officer's signature 


Printed name and title 
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ATTACHMENT C 
Property to be Searched 


This warrant applies to information associated with the following Apple account: 


that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at 


One Apple Park Way, Cupertino, California 95014. 
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ATACHMENT D 
Particular Things to be Seized 


I. Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, files, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment A: 


a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 


b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers “(MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (‘IMST’), and International Mobile 
Station Equipment Identities (“IMEI”); 


ren The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 


d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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ẹ; The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 


f. All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 


g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 


h. All records pertaining to the types of service used; 


i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 


j. All files, keys, or other information necessary to decrypt any data produced in an 


encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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IL. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15, 2016 to November 10, 2016. 


including: 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to hacked material; 


All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Roger sone, a Julian 


Assange, or any individual associated with the Trump Campaign; 


All images, messages, communications, calendar entries, search terms, and 
contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 

Communication, information, documentation and records relating to who created, 
used, or communicated with the account or identifier, including records about 
their identities and whereabouts; 


Evidence of the times the account was used; 


All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 


Passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 


Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


All existing printouts from original storage which concern the categories 
identified in subsection II.A; and 


All “address books” or other lists of contacts. 
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JUL 12 2018 
IN THE UNITED STATES DISTRICT COURT ile U.S. District & Bankruptey 
FOR THE DISTRICT OF COLUMBIA OF the District of Columb 
IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02401 


i ED WITH Assigned To : Howell, Beryl A. 
Assign. Date : 7/12/2018 


Description: Search & Seizure Warrant 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the ““Warrant’’), 
and to require Apok, Inc. (“Apple”) an electronic communication and/or remote computing 
service headquartered at a company headquartered at 1 Infinite Loop, Cupertino, CA not to 
disclose the existence or contents of the Wait pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses, See 18 U.S.C. § 2705(b)(2)-(S5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant moton to seal, and this Order be SEALED until farthest order of the Court; 


and 
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` IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Apple and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Apple for the purpose of receiving legal advice) for a period of one year or until 


further order of the Court. 


Let bh? 


THE HONORABLE BERYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 


Dat 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT JUL 12 20% 


for the 
Clerk, U.S. Distri 
District of Columbia -Courts for the District ot Colt 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


_— ASSOCIATED WITH 


APPLICATION FOR A SEARCH WARRANT 


Case: 1:18-sc-02401 | 
Assigned To : Howell, Beryl A. 
Assign. Date : 7/12/2018 
Description: Search & Seizure Warrant 


1, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that J have reason.to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location}: : 


See Attachment C. 

located in the __Northern District of California , there is now concealed (identify the 
person or describe the property to be seized): 

See Atiachment D. 


This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
iM evidence of a crime; 
contraband, fruits of crime, or other items illegally possessed; 
& property designed for use, intended for use, or used in committing a crime; 


O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of; 


Code Section Offense Description 
18 U.S.C. § 371 i Conspiracy , 
18 U.S.C. § 1030 Unauthorized Access of a Protected Computer 


The application is based on these facts: 


See attached Affidavit. 


Z Continued on the attached sheet. 
mi Delayed noticeof_ days (give exact ending date if more than 30 days: = ) is requested 


under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: Applicant's signature 
_ Andrew Mitchell, Special Agent, FB! 


Printed name and title 


Aaron Zelinsky (ASC) 


Sworn to before me and signed in my presence. 


Date: 71212018 ET Z- ial : 


Judge's signature 


City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge’ 


_ Printed name and title 
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FILED 


IN THE UNITED STATES DISTRICT COURT JUL 12-208 


FOR THE DISTRICT OF COLUMBIA ` Clerk, U.S. District & Bankruptcy 
Courts for the District of Columbia. 


IN THE MATTER OF THE SEARCH OF © 
INFORMATION ASSOCIATED WITH Case No. } $-SC- 77 


AMENDED AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 
I. I make this affidavit in support of an application for a search warrant for 
information associated with the following: 


a. The email account iina by CSC Holdings (“Target 


Account 1”), described further in Attachment A. 


b. The Apple Account (including email) associated vi o maintained 


by Apple, Inc. (Target Account 2), described further in Attachment C. 

c. The email accoun {iE maintained by Windstream Communications 
(“Target Account 3”), described further in Attachment E. 

The information to be disclosed by CSC Holdings, Apple, Inc., and Windstream 
Communications (“the Providers”) and searched by the government is described in the following 
paragraphs and in Attachments A-F. This affidavit is made in support of an application for a 
search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 

2. I, Aides Mitchell, am a Special Agent with the Federal Bureau of Investigation 
(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and 


experience in investigating criminal and national security matters. 


amass 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the sted warrant and does not set 
forth all of my knowledge about this matter. 

4. oe the submission of.this warrant application, the Special Counsel’s Office 
complied with all relevant Department of Justice policies, including the requirement for 
Departmental approval under the Department’s policy regarding obtaining information from 
members of the news media, 28 C.F.R. 50.10. 

Ds Based on my fainting and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain communications relevant to 
violations of 18 U.S.C. § 371 (conspiracy) and 18 U.S.C. § 1030 (unauthorized access of a 
protected computer). | 

JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court). . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 2711(3)(A)(i).. The offense conduct included activities in Washington, D.C., a detailed below, 
including in paragraph 19. 
SUMMARY 
7. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to “Get to 


Assange” at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” On or about July 


31, 2016, STONE also instructed CORSI to have o A Julian 


2 
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ASSANGE. On or about August 2, 2016, CORSI responded to STONE that the “word is friend 
in embassy [ASSANGE] plans 2 PER One shortly after I’m back. 2nd in October, 
Impact planned to be very damaging.... Time to let more than Podesta to be exposed as in bed w 
enemy if they are not ready to drop HRC.” After receipt of that message, on or about August 21, 
2016, using @RogerJStoneJR, Stone tweeted: “Trust me, it will soon the [sic] Podesta’s time in 
the barrel. #CrookedHillary.” 

8. inao disclosures subsequently occurred on or about the times CORSI 
predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the United 
States (“shortly after I’m back”), Guccifer 2.0 released hacked information related to the 
Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day 
~ the Washington Post published a breaking story about an Access Hollywood videotape of then- 
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked 
from the account of John Podesta. 

9. Furthermore, on the day of the Access Hollywood video disclosure, there were 
phone calls between STONE and CORSI after the Washington Post contacted STONE prior to 
publication. At approximately 11:00AM, the Washington Post received a tip regarding the 
Access Hollywood video. Approximately one hour later, shortly before noon, STONE received 
a call from the Washington Post. Approximately ninety minutes later, before 2:00 PM, STONE 
called CORSI and they spoke. Approximately forty minutes later, CORSI called STONE and the 
two spoke again at length. At approximately 4:00PM, the Washington Post published its story 
regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks tweeted out its 


first release of emails hacked from John Podesta. 
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PROBABLE CAUSE. 


A. Background on Relevant Individuals 
i. Roger STONE 

11. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
-continued to make media appearances in support of Trump’s presidential campaign. As 
described further below, STONE also maintained contact with individuals employed by the 
Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick 
GATES. 


ii Jerome CORSI 
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12. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 


B. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed 
Hacking Activity during the 2016 Presidential Election 


PPA AEA vst tte 


ST ES SA UR AT SORES TET 
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14. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 


the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following, with emphasis added: 

15. The U.S. Intelligence Community (USIC) is confident that the Russian 
Government directed the recent compromises of emails form US persons and institutions, 

_ including from US political organizations. The recent disclosures of alleged hacked emails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and disclosures are 
intended to interfere with the US election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scone and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

16. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

17. “Russian President Vladimir Putin ordered an influence campaign in 2016 aimed 
at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, diie [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 


18. - The USIC also described, at a high level, some of the techniques that the Russian 
6 
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government employed during its interference. The USIC sacumaned the efforts as a “issan 
messaging strategy that blends covert intelligence operations—such as cyber activity—with 
overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, 
and paid social media users or ‘trolls.’” | 

19. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[iJn July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities to 
the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted in 
the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” The GRU is the 
foreign sniltiaey intelligence agency of the Russian Ministry of Defense, and is Russia’s largest 
foreign intelligence agency. 

20. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

21. Gucecifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

C. Additional Hacking Activity by Individuals Associated with the GRU 

22. The Special Coeds Office has determined that individuals associated with the 

GRU continued to engage in hacking activity related to the 2016 campaign through at least 


November 1, 2016. 


PANETE ETEEN NONE 
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23. For example, in or around September 2016, these individuals successfully gained ` 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
. used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

24. On or about September 4, 2016, individuals associated with the GRU stole the 

‘emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

25. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. | 

D. Roger Stone’s Public Interactions with Guccifer 2.0 and WikiLeaks 

26. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly aibid the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared aad publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “{t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. . 

27. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 


28. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 
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“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in 
the article and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ Il see he explains 
who he is and why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a 
fateful and wise decision. He went to WikiLeaks with the DNC files and the rest is history. Now 
- the world would see for themselves how the Democrats had rigged the game.” 

29. -On August 8, 2016, Stone addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential ean Specifically, Stone was asked: “With regard to the 
October surprise, what would be your forecast on that given what Julian Assange bas intimated 
he’s going to do?” Stone responded: “Well, it could be any number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 
served as an intermediary. 

30. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the Democratic Congressional Campaign 
Committee (DCCC). 

31. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 


2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
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Twitter account was reinstated. 

32. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

33. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that Manafort had worked with a Washington D.C.-based lobbying firms to influence U.S. policy 
toward Ukraine. 

` 34. On August 21, 2016, using @RogerJStoneJR, Stone tweeted stating: “Trust me, it 
will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that 


cee 


same day, Stone reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[Assange], the public [could] expect to see much more from the exiled whistleblower in the form 
of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

35. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 
that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly basis 
fairly soon. And that of course will answer the question as to what exactly what was erased on 
that email server.” 

36. On Saturday, October 1, 2016, using @RogerJStoneJr, Stone Tweeted, 


“Wednesday @ HillaryClinton is done. #WikiLeaks.” 


37. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
10 
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tweeted regarding an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement — 
which was part of WikiLeaks’ 10-year anniversary celebration — Stone told Infowars that his 
intermediary described this release as the “mother load.” On October 5, 2016, Stone used 
@RogerJStoneJr to tweet: “Payload coming. #Lockthemup.” 

38. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 


39. Approximately a half hour later, at 4:32 P.M., WikiLeaks sent a Tweet reading 


“RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer” and containing a link 

to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 
40.  WikiLeaks continued to release John Podesta’s hacked emails through Election 

Day, November 8, 2016. On October 12, 2016, John Podesta — referring back to Stone’s August 


21, 2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption 


to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reassnable belief that [Assange] may have passed this information on to 
[Stone].” Commenting to the NBC News, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of E A I’m not implying I have any influence with 
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 


has all of the e-mails that Huma Abedin and Chery! Mills, the Clinton aides, thought were 


deleted. I hear that through my emissary.” 
11 
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41. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel — 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 


limited things I did predict (Oct disclosures) all came true.” 


E. Roger Stone’s Private Twitter Direct Messages with WikiLeaks and Julian Assange. 


42. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 

43. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 


strategy of attacking me- cordially R.” 


44. Less than an hour later, @wikileaks responded by direct message: “We appreciate . 


that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

45. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you're lying. Your 


operation leaks like a sieve. You need to figure out who your friends are.” 
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' 46. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with acess message less than a minute later: “We are 
now more free to communicate.” 

47. In addition, @RogerJStoneJr also exchanged direct messages with Julian 
Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJ StoneJr directly | 
messaged @JulianAssange, an address associated with Julian Assange in numerous public 
reports, stating: “Still nonsense. As a journalist it doesn't matter where you get information only 

that it is accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an ia restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don't know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they're doing quite a lot. On the 
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

48. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 


F. CORSI’s Communications with STONE, Pe... Others Regarding 
Forthcoming Leaks. 
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49, On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE’s = .::. : ii On October 


17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE’s R 

E On or about December 19, 2017 Chief Judge Beryl A. Howell issued a 
search warrant for SAM account. On or about March 14, 2018, Chief Judge Beryl 
A. Howell issued a search warrant for STONE’s iCloud account, Information recovered pursuant 
to those search warrants indicated the following: 

50.  Onor about May 15, 2016 emailed CORSI at Target Account 3: 
“Here is my flight schedule. Need to get something confirmed now . . . .” CORSI responded, “I 
copied Roger Stone so he knows your availability to meet Manafort and DT this coming week.” 
CORSI appears to have forwarded the message to STONE, who replied to CORSI that, “May 
meet Manafort -guarantee nothing.” 

51. On or about May 16, 2016 WG CORSI on Target Account 3: 
“Outside of Wednesday 2-4 ... Lam open. Do you have times for meeting on other things? 
Flexible re DJT. How about the head of finance for them?” CORSI responded, “I will work on 
other meetings today,” TE replied, “Do you [want] me to bring you anything from the 
Old Country? I have a meeting now from 2-6 on Wednesday. Open all other times!!!” 

52. Onor about May 18, 2016, CORSI, using Target Account 3, emailed STONE 


with the Title, “Roger -- why don't you look this over before I send it o believe that 


o N I did manage to see Mr. Trump for a few minutes today as we were 


waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 


was very cordial. He would look for this memo from you this afternoon.” 


14 


a S 


Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 24 of 58 


53. On July 25, 2016, STONE sent an email to CORSI at Target Account 1 with the 
subject line, “Get to Assange.” The body of the message read: “Get to Assange [alt Ecuadorian 
Embassy in London and get the pending WikiLeaks emails...they deal with Foundation, 
allegedly.” 

54. On or about July 31, 2016, STONE emailed CORSI at Target Account 1 with the 
subject line, “Call me MON.” The body of the email read: , o o o should see Assange[.| 

BE should find Bernie [S]anders brother who called Bill a Rapist — turn him for Trump[.] 
aa should find Ee or more proof of Bill getting kicked out.” 

55, Onor about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE using Target Account 1, 
“Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact 
planned to be very damaging. Signs are Fox will have me on mid-Aug. more post Ailes shakeup 
_ underway. Expect Shine to surface victor, for now. Post-DNC bump for HRC an artifact of 
rigged polling. Won't last. I expect presidential campaign to get serious starting Sept. Still in pre- 
season games. Time to let more than Podesta to be exposed as in bed w enemy if they are not 
ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start 
suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of 
next dump focus, setting stage for Foundation debacle.” Investigators believe that CORSI’s 
reference to a “friend in embassy [who] plans 2 more dumps” refers to Julian ASSANGE, the 
founder of WikiLeaks, ako resided in Ecuador’s London Embassy in 2016. 

56. On or about August 5, A O an associate of STONE’s, emailed 
him a link to a poll indicating that Clinton led Trump by 15 points. STONE responded “enjoy it 


while u can[.] I dined with my new pal Julian Assange last night.” RE subsequently 
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`- stated to investigators that, around the same time; STONE told him he had gone to London to 
meet ASSANGE. [RR so stated that in 2018, told STONE he would be 
interviewed by the FBI and would have to divulge the conversation about meeting ASSANGE. 
STONE told —a he was joking and had not actually met Assange. 

57. Onor about August 15, 2016, CORSI messaged STONE using Target Account 
3: “Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it’s not 
over yet. More to come than anyone realizes. Won’t really get started until after Labor Day. Pm 
in NYC this week. Jerry.” 

58. Onor about August 31, 2016, CORSI using Target Account 1 emailed STONE: 
“Did you get the PODESTA writeup.” STONE replied “yes.” 

59. On or about August 31, 2016, CORSI, using Target Account 2, messaged 
STONE, “Podesta paid $180k to invest in Uranium One — was hired by Rosatom in Giustra 
scandal. Podesta now under FBI investigation — tied to Ukraine Yanukovych — Panama papers ` 
reveals Podesta hired by S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to 
Russia undermine Clinton false narrative attempting to tie Trump to Putin.” 

60. Onor about September 6, 2016, CORSI emailed STONE using Target Account 
3: “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

61. On or about September 24, 2016, O ë ited CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded using Target 
Account 3, “We have secure back channel through Roger. I saw him again in NYC last Friday 
and spoke to him about it again today.” TE vrote back, “Awaiting secret file. 
Explosive... Hope you are well. Can't wait for the debate. Channeling Reagan, I hope!” CORSI 


responded, “Keep me posted about file[.]” In a subsequent meeting with investigators, 
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k= sy indicated this conversation concerned possible derogatory information he was trying ` 


to obtain from Turkey. 

62. On or about October 3, 2016, an associate of STONE emailed STONE and asked: 

“Assange — what’s he got? Hope it’s good.” Stone wrote back, “It is. Pd tell Bannon but he 

. doesn’t call me back. My book on the TRUMP campaign will be out in Jan. Many scores will be 
settled.” The associate forwarded the email to Steve BANNON and wrote: “You should call 
Roger. See below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to 
worry about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

63. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been P in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
ionnaion previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

64. Onor about October 4, 2016, CORSI messaged STONE using Target Account 2, 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

65. That same day, BANNON emailed STONE, “What was that this morning???” 
STONE replied, “Fear. Serious security concern. He thinks they are going to kill him and the 
London police are standing done [sic]. “ BANNON wrote back, “He didn’t cut deal w/ 


clintons???” Stone replied, “Don't think so BUT his lawyer a: a big democrat.” 
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66. | When BANNON spoke with investigators during a voluntary proffer on February 
_ 14, 2018, he initially denied ow whether the October 4, 2016 email to STONE was about 
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE 
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. 


67. According to a publicly available news article,’ at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call fan 
a source regarding a previously unaired video of candidate Trump. According to the same article, 
“Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage from a 
2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, calling 
Trump’s campaign, ‘Access Hollywood’ and NBC Gado 

68. According to phone records o at approximately 
11:27 AM, CORSI placed a call to STONE which STONE did not answer. 

69. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

70. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

71. At approximately 2:18PM, CORSI called STONE and the two spoke for 


approximately twenty minutes. 


1 https://www. washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was- 
on/2016/10/07/3 1d74714-8ce5-1 1e6-875e-2c1 bfe943b66_story.html 
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72. At approximately 4:00PM, the Washington Post published a story regarding the 


Access Hollywood tape. 


73. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, when CORSI emailed STONE on Target Account I, he wrote “I 


expect that much of next dump focus, setting stage for Foundation debacle.” 


74. At approximately 6:27PM, [iii sent STONE an email titled, 


“WikiLeaks — The Podesta Emails” with a link to the ERE E IES, Podesta emails. 
Approximately ten minutes later, STONE forwarded — message to CORSI at Target 
Account 1 without comment. STONE does not appear to have forwarded the email to any other 
individual. 
H. STONE Requests to CORSI for “SOMETHING” to Post About Podesta After 

STONE Is Accused of Advance Knowledge of the Leak 

75. On or about October 8, 2016, STONE messaged CORSI at Target Account 2, | 
“Lunch postponed — have to go see T,” CORSI responded to STONE, “Ok. I understand.” 
Approximately twenty minutes later, CORSI texted, “Clintons know they will lose a Wak of 
Paula Jones media with T giek Foundation, using Wikileaks Goldman Sachs speech 
comments, attacking bad job numbers.” 

76. Onor about Wednesday, October 12, 2016, at approximately 8:17 EDT, STONE 
emailed CORSI at Target Account 1, asking him to “send me your best podesta links.” STONE 
emailed CORSI at approximately 8:$$ EDT, “need your BEST podesta pieces.” CORSI wrote 


back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on Podesta is 
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complicated. Two articles in length. I can give you in raw form the stuff I got in Russian — 
translated but to write it up so it's easy to understand will take weekend. Your choice?” 
77. On or about that same day October 12, 2016, Podesta accused STONE of having 


advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI, 


using Target Account 1, emailed STONE with a subject line “Podesta talking points.” Attached 


to the email was a file labeled, “ROGER STONE podesta talking points Oct 12 2016.docx.” The 


“talking points” included the statement that “Podesta is at the heart of a Russian-government 


money laundering operation that benefits financially Podesta personally and the Clintons through — 


the Clinton Foundation.” 

78. CORSI followed up several minutes later with another email titled, “Podesta 

talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
_ CORSI back via the Hotmail Account, “Got them and used them.” 

79. On or about Thursday, October 13, 2016, CORSI, using Target Account 3, 
emailed STONE: “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING fe 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since J am the one under attack by Podesta and now Mook.” CORSI wrote 
back to STONE, “PIL give you one more — NOBODY YET HAS THIS[:] It looks to me like 

HEE ‘immed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. - 


Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since Ihave now promised it to a dozen MSM reporters[.]” 

80. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email with the Subject, “ROGER STONE article RUSSIAN MAFIA STYLE 
MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN PODESTA.” The text 
stated: “Roger[,] You are free to publish this under your own name.” That same day, STONE 
posted a blog post with fis title, “Russian Mafia money laundering, the Clinton Foundation and 
John Podesta.” In that post, STONE wrote, “although I have had some back-channel 
communications with Wikileaks I had no advance notice about the hacking of Mr. Podesta nor I 
have I ever received documents or data from Wikileaks.” The post then asked, “Just how much 
money did o a controversial Russian billionaire investor with ties to the 
Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional 
bank owned 99.978 percent by p= with the money transferred via Deutsche Bank and 
Trust Company Americas in New York City, with the money ending up in a private bank 
account in the Bank of America that is operated by the Clinton Foundation?” 

81. — Onor about October 14, 2016, CORSI sent a message using Target Account 2 to 
STONE, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

82. On or about October 17, 2016, CORSI messaged STONE using Target Account 
2, “On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just . 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 


21 


Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 31 of 58 


83. On or about October 17, 2016, CORSI, using Target Account 1, emailed STONE 
with the subject, “Fwd: ASSANGE...URGENT.. i CORSI wrote, “From a very trusted source,” 
and forwarded an email with the header information stripped out, showing only the body text. 
The email read, “Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will 
drop the goods on them if they move to extradite him. My guess is that he has a set of dead man 
files that include Hillary. It’s what they used to call a ‘Mexican stand offf. Only hope is that if 
Trump speaks out to save him[.] Ortisnwise he’s dead anyway, once he’s dropped what he has. If 
HRC wins, ee can kiss his life away. Interesting gambit Assange has to play out. He’s 
called Podesta’s bluff and raised him the election.” 

84. Onor about October 18, 2016, CORSI messaged STONE using Target Account 
2, “Pls call. Important.” | 

85. On or about October 1 9, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

86. On or about November 8, 2016, the United States presidential election took place. 

87. On or about November 9, 2016, CORSI, using Target Account 2, messaged 
STONE, “Congratulations, Roger. He could not have done it without you.” 

88, On or about November 10, 2016, CORSI messaged STONE using Target 

Account 2, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m 


in London. Have some interesting news for you.” 
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‘ BACKGROUND CONCERNING EMAIL 
96. In my training and experience, I have learned the Providers provide a variety of 
on-line services, including electronic mail (“email”) to the public. The Providers allow 
subscribers to obtain email accounts at the domain names identified in the email address 
-contained in Attachment A and C. Subscribers obtain an account by registering with the 
Providers. During the registration process, the Providers ask subscribers to provide basic 
personal information. Therefore, the computers of the Providers are likely to contain stored 


electronic communications (including retrieved and unretrieved email) for their subscribers and 


information concerning subscribers and their use of services, such as account access information, 


email transaction information, and account application information. In my training and 
experience, such information may constitute evidence of the crimes under investigation because 
the information Si be used to identify the account’s user or users. | 

97. In my training and experience; emai Providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other HaT; alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

98. In my training and experience, email Providers typically retain certain 


transactional information about the creation and use of each account on their systems. This 
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information can include the date on which the account was created, the length of service, records 
of log-in (Z.e., session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or losd; the methods used to connect to the account 
(such as logging into the account via the Providers’ website), and other log files that reflect 
usage of the account. In addition, email Providers often have records of the Internet Protocol 
address (“IP address”) used to register the account and the IP addresses associated with particular 
logins to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

99. In my training and experience, in some cases, email account users will 
communicate directly with an email service Providers about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. Email Providers 
typically retain records about such communications, including records of contacts between the 
user and the Providers’ support services, as well as records of any actions taken by the Providers 
or user as a result of the communications. In my training and experience, such information may 
constitute evidence of the crimes under investigation ae the information can be used to 
identify the account’s user of users. 

100. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 


the account. This “user attribution” evidence is analogous to the search for “indicia of 
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occupancy” while executing a search warrant at a residence. For example, email 
_ communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, 


information maintained by the email Providers can show how and when the account was 


accessed or used. For example, as described below, email Providers typically log the Internet 


Protocol (IP) addresses from which users access the email account, along with the time and date 


of that access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time (e.g., location information integrated into an image i. video sent 


via email). Last, stored electronic data may provide relevant insight into the email account 


owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime (e. g., 
communications relating to the crime), or consciousness of guilt (e.g., deleting communications 
in an effort to conceal them from law enforcement). 

- 101. In my training and experience, information such as search history can help to 
show the state of mind of an individual at the time the search was made, as well as the 


individuals potential advance knowledge of events, as they search to see if the anticipated event 


has occurred. | 
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INFORMATION REGARDING APPLE ID AND iCLOUD? 


102. Apple is a United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 


the Mac OS operating system. 


103. Apple provides a variety of services that can be accessed from Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

° Apple provides email service to its users through email addresses at the 
domain names mac.com, me.com, and icloud.com. 

° iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (“Messages”) 
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to 
conduct video calls. 

° iCloud is a file kosing storage, and sharing service provided by Apple. 
iCloud can be utilized through numerous iCloud-connected services, and can also be used to 


store iOS device backups and data associated with third-party apps. 


2 The information in this section is based on information published by Apple on its website, including, but 


not limited to, the following document and webpages: “U.S. Law Enforcement Legal Process Guidelines,” available 
at http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf; “Create and start using an Apple ID,” 
available at https://support.apple.com/en-us/HT203993; “iCloud,” available at http://www.apple.com/icloud/; “What 
does iCloud back up?,” available at https://support.apple.com/kb/PH12519; “iOS Security,” available at 
https://www.apple.com/business/docs/iOS_Security_Guide.pdf, and “iCloud: How Can I Use iCloud?,” available at 
https://support.apple.com/kb/PH26502. 
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e iCloud-connected services allow users to create, store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and 
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 
to share those images and videos with other Apple basie iCloud Drive can be used to 
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable 
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers 
on all of the user’s Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers, 

- Keynote, and Notes), enables iCloud to be used to create, store, and share documents, 
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and 
passwords, credit card information, and Wi-Fi network information synchronized across multiple 
Apple devices. 

° Game Center, Apple’s social gaming network, allows users of Apple 
devices to play and share games with each other. 

° Find My iPhone ows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. Find My 

Friends allows owners of Apple devices to share locations. 

e Location Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. 

° App Store and iTunes Store are used to purchase and download digital 


content. iOS apps can be purchased and downloaded through App Store on iOS devices, or 
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through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS, Additional digital content, including music, movies, and pecans shows, can be 
purchased through iTunes Store on iOS devices and on desktop and laptop computers running 
either Microsoft Windows or Mac OS. 

104. Apple services are accessed through the use of an “Apple ID,” an account created 
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 
syncing mechanism. 

105. An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
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Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 
associated with an Apple ID by the user. 

106. Apple captures information associated with the creation and use of an Apple ID. 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers. The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgot” pages on 


Apple’s website. In addition, Apple captures the date on which the account was created, the 


length of service, records of log-in times and durations, the types of service utilized, the status of 
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the account (including whether the account is inactive or closed), the methods used to connect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access 
the account, and other log files that reflect usage of the account. 

107. Additional information is captured by Apple in connection with the use of an 
Apple ID to eds certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 
invitation logs” for FaceTime calls, “query logs” for iMessage, and “mail logs” for activity over 
an Apple-provided email account. Records relating to the use of the Find My iPhone service, 
including connection logs and requests to remotely lock or erase a device, are also maintained by 
Apple. - 

108. Apple also maintains snforindiion about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“ICCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, including the Media Access Control address. (MAC 
address”), the unique device identifier ““UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
captured when used to access services through icloud.com and apple.com. Apple also retains 


records related to communications between users and Apple customer service, including 
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communications regarding a particular Apple device or service, and the repair history for a 
device. 

109. Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, eninge email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (i Work and iCloud Drive); and 
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain). 
iCloud can also be used to store iOS device backups, which it contain a user’s photos and 
videos, iMessages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call history, contacts, calendar events, reminders, 
notes, app data and settings, Apple Watch backups, and other data. Records and data associated 
with third-party apps may also be stored on iCloud; for example, the iOS a for WhatsApp, an 
instant messaging service, can be configured to regularly back up a ieee instant messages on 
iCloud Drive. Some of this data is stored on Apple’s servers in an encrypted form but can 


nonetheless be decrypted by Apple. 


110. In my training and experience, evidence of who was using an Apple ID and from 
where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 


suspicion. 
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INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 
111. I anticipate executing this warrant under the Electronic Conka Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant. 
to require Google to disclose to the government copies of the records and other information 


(including the content of communications) associated with the accounts in Attachment A, C, and 


E and particularly described in Section I of Attachment B, D, and E. Upon receipt of the 


information described in Section I of Attachments B, D, and F, government-authorized persons 


will review that information to locate the items described in Section II of Attachment B, D, and 


F. The items identified in Attachments A-F will also be screened by reviewers not on the 


prosecution team to identify and filter out privileged material. 
CONCLUSION 
112. Based on the forgoing, I request that the Court issue the proposed search warrant. 
113. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is Bet 


required for the service or execution of this warrant. 
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REQUEST FOR SEALING 
114. I further request that the Court order that all papers in support of this application, 


including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Andrew Mitchell 


Special Agent 
Federal Bureau of Investigation | 


Subscribed and sworn to before me on this i A ee of July, 2018. 


Cai 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the following email account: 


ia 


that is stored at premises owned, maintained, controlled, or operated by CSC Holdings, LLC, 


1111 Stewart Avenue, Bethpage, NY 11714. 


35 


I 


Case 1:19-mc-00029-CRC Document 29-9 Filed 04/28/20 Page 45 of 58 


ATTACHMENT B 
Particular Things to be Seized 


Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f, the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 


a. 


The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


. All existing printouts from original storage of all of the electronic mail described above 


in Section LA. above; ' 
All internet search data including all queries and location data; 


All transactional information of all activity of the account described above in Section I.A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 


All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 


Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 


All records indicating the services available to subscribers of the electronic mail address 
described above in Section 1.A.; 
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II. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15, 2016 to November 10, 2016. 
including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Roger Stone, O= DQ Assange, or 
any individual associated with the Trump Campaign; 


All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and ali preparatory steps taken in furtherance of the 
above-listed offenses; 


c. Communication, information, documentation and records relating to who created, used, ot 
communicated with the account or identifier concerning the messages identified above, 
‘including records about their identities and whereabouts; 


d. Evidence ofthe times the account was used; 


e. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


f. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


g. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


h. All existing printouts from original storage which concern the categories identified in 
subsection II.A; 
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ATTACHMENT C 
Property to be Searched 


This warrant applies to information associated with the following Apple account: 


: 


that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at 


One Apple Park Way, Cupertino, California 95014. 


ee ee eee ee ae en ete tere 
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- ATACHMENT D 
Particular Things to be Seized 


I. Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, files, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment A: 


a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 


b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers ““UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (IMST), and International Mobile 
Station Equipment Identities (“IMEI”); - 


c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 


d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; ; 
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e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork - 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 


f. All activity; connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 


g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 


h. All records pertaining to the types of service used; 


i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 


j. All files, keys, or other information necessary to decrypt any data produced inan 


encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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H. ` Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15, 2016 to November 10, 2016. 


including: 


. All records, information, documents or tangible materials that relate in i way to 


a. All records, information, documents or tangible materials that relate in any way to 


communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to hacked material; 


communications or meetings involving Roger Stone, Julian 


Assange, or any individual associated with the Trump Campaign; 


All images, messages, communications, calendar entries, search terms, and 
contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


. Communication, information, documentation and records relating to who created, 


used, or communicated with the account or identifier, including records about 
their identities and whereabouts; 


Evidence of the times the account was used; 


All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 


. Passwords and encryption keys, and other access information that may be 


necessary to access the account and other associated accounts; 


Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


All existing printouts from original storage which concern the categories 
identified in subsection H.A; and 


All “address books” or other lists of contacts. 
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. ATTACHMENT E 
Property to be Searched 


This warrant applies to information associated with the following email account: 


that is stored at premises owned, maintained, controlled, or operated by Windstream 
Communications, Inc, with offices located at 11001 Executive Center Drive, Little Rock, 


Arkansas, 72211. 
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ATTACHMENT F 
Particular Things to be Seized 


Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been — 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment E: 


a. 


The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


All existing printouts from original storage of all of the electronic mail described above 
in Section LA. above; 


All internet search data including all queries and location data; 


All transactional information of all activity of the account described above in Section LA, - 


including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 


All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 


Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 


All records indicating the services available to subscribers of the electronic mail address 
described above in Attachment E; 
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TL Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15, 2016 to November 10, 2016. 
including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Roger Stone, Julian Assange, or 
any individual associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory stopsit taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


i. All existing printouts from original storage which concern the categories identified 
above; 
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_ IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc—-02401 


INFORMATION ASSOCIATED WITH - Assigned To : Howell, Beryl A. 
Assign. Date : 7/12/2018 


Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 


_ moves the Court for an Order placing the above-captioned warrant and the application and affidavit — 


in support thereof (collectively herein the “Warrant’”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non- 
disclosure, the proposed Order would direct Apple Inc. (“Apple”) an electronic communication 
and/or remote computing services provider hidga in Cupertino, California not to notify 
any other person (except attorneys for Apple for the purpose of receiving legal advice) of-the 
existence or content of the Warrant for a period of one year or until further order of the Court. 
JURISDICTION AND LEGAL BACKGROUND 

l. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon yv. Warner Communications, Ine., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in e the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2; In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as diad by 18 U.S.C. § 2711. Specifically, the Court is a 


_ “district court of the United States . . . that — has jurisdiction over the offense being investigated.” 
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18 U.S.C. § 2711(3)(A)). As discussed fully below, acts or omissions in furtherance of the 
offense under investigation occurred within Washington, D.C. See 18 U.S.C. § 3237. 
3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Apple provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Apple may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(1)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 
4. The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 
notification. In relevant part, Section 2705(b) provides as follows:! 
(b) Preclusion of notice to subject of governmental access. —- A governmental 
entity acting under section 2703 . . . may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 
deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 


(1) endangering the life or physical safety of an individual; 
(2) flight from prosecution; 


1 Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. | 


| 
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(3) destruction of or tampering with evidence; 
(4) intimidation of potential witnesses; or 
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 


18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 
requisite showing about potential consequences of notification: 


The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 


In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 


Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 


5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 


command Apple not to notify any other person (except attorneys for Apple for the purpose of 
receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 


FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. At the present time, law enforcement officers of the FBI are conducting an 
investigation into violations related to 18 U.S.C. § 1030 (unauthorized access of a protected 
computer) and 18 U.S.C. § 371 (conspiracy) arising out of the conduct of Roger Stone, Jerome 
Corsi, and others. It does not appear that Stone and Corsi are currently aware of the full nature and 
scope of the ongoing FBI investigation. Disclosure of this warrant to Corsi could lead him to 


destroy evidence or notify others who may delete information relevant to the investigation. 
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REQUEST FOR SEALING AND NON-DISCLOSURE 


7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Apple and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Apple for the purpose of receiving legal 
advice) for a period of one year or until further order of the Court. Such an order is appropriate 
because the Warrant relates to an ongoing andl investigation, the full scope of which is neither 
public nor known to the targets of the investigation, and its disclosure may alert these targets to 
the ongoing investigation and its scope. Once alerted to this investigation, potential targets would 
be immediately prompted to destroy or conceal incriminating evidence, alter their operational 
as to avoid future detection, and otherwise take steps to undermine the investigation and avoid 
future prosecution. In particular, given that they are known to use electronic communication and 
remote computing services, the potential target could quickly and easily destroy or encrypt digital 
evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 

9, There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 


§ 2705(bX(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
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compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. | 

10. Based on prior dealings with Apple the United States is aware that, absent a court 
order under Section 2705(b) commanding Apple not to notify anyone about a legal request, it is 
Apple’s policy and practice, upon receipt of a warrant seeking the contents of electronically stored 
wire or electronic communications for a certain account, to notify the subscriber or customer of 
the existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Apple not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for Apple for the purpose of receiving legal advice) for a period of one year or 
until further order of the Court. 

Respectfully submitted, 


ROBERT S. MUELLER, III 
Special Counsel 


i aron S.J. ZelingKy 


The Special Counsel’s Office 
(202)-5 14-0637 l ' 
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AO 93 (Rev, 11/£3) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 


District of Columbia 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH 


Case: 1:18-sc-02403 | 
Assigned To : Howell, Beryl A. | 
Assign. Date : 7/12/2018 | 
Description: Search & Seizure Warrant 


Nr ee ee Soe Sue ee” 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Eastern _ District of New York 


(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before sully 26, 2018 (not to exceed 14 days) 
Mf in the daytime 6:00 a.m. to 10:00 p.m, O at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. , 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell 
(United States Magistrate Judge} 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for __ days (not to exceed 30) O until, the facts justifying, the later specific date of 


Date and time issued: aly PFA 20 Hi af $: £0 LBL. A. 4 pF = 


Judge’s signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the following email account: 


: 


that is stored at premises owned, maintained, controlled, or operated by CSC Holdings, LLC, 


1111 Stewart Avenue, Bethpage, NY 11714. 
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ATTACHMENT B 
Particular Things to be Seized 


IL Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 


a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


b. All existing printouts from original storage of all of the electronic mail described above 
in Section LA. above; 


c. All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above in Section I.A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 


e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 


£ Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 


g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section LA.; 
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Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15, 2016 to November 10, 2016. 
including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Roger Stone, Julian Assange, or 
any individual associated with the Trump Campaign; 


All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


c. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


d. Evidence of the times the account was used; 


e. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


f. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


g. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


h. All existing printouts from original storage which concern the categories identified in 
subsection ILA; 
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PILED 


IN THE UNITED STATES DISTRICT COURT JUL 12 2018 
FOR THE DISTRICT OF COLUMBIA Glerk, U.S. District & Bankruptcy 
Courts for the District of Columbia 
IN THE MATTER OF THE SEARCH OF | Case: 1:18-sc-02403 
INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A. 


Assign. Date : 7/12/2018 
_ Description: Search & Seizure Warrant 


ORDER 

The United States has filed a nii to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require CSC Holdings, an electronic communication and/or remote computing service s 
headquartered at 1111 Stewart Avenue, Bethpage, NY 11714, not to disclose the existence or 
contents of the Warrant pian to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is. hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 


EG aga SETS SSE 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), CSC Holdings and 
its employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for CSC Holdings for the purpose of receiving legal advice) for a period of one year 


unless otherwise ordered by the Court. 


THE HONORABLE Ll le A. LEG 


CHIEF UNITED STATES DISTRICT JUDGE 


yio 


Date 


Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 8 of 57 


AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES. DISTRICT COURT “JUL 12 2018. 
for the Clerk, U.S. District & Bankruptcy 
District of Columbia Courts for the District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH 


Case: 1:18-sc—02403 

Assigned To : Howell, Beryl A. 

Assign. Date : 7/12/2018 

Description: Search & Seizure Warrant 


Neel Nene ee Na 


APPLICATION FOR A SEARCH WARRANT 


` I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A. 

located in the Eastern District of New York , there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment B. 


This warrant is sought pursuant to 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 
m contraband, fruits of crime, or other items illegally possessed; 
we property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. § 371 Conspiracy 
18 U.S.C. § 1030 Unauthorized Access of a Protected Computer 


The application is based on these facts: 


See attached Affidavit. 


iW Continued on the attached sheet. 


(J Delayed notice of ___ days (give exact ending date if more than 30 days: _ > ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached ; 


Applicant’s signature 


Reviewed by AUSA/SAUSA: 
(ASC) 


Aaron Zelinsky Andrew Mitchell, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


Date: 7/12/2018 i PLAB A ERA : 


Judge's signature 


City and state: Washington, D.C. l Hon. Bery! A. Howell, Chief U.S. District Judge 


Printed name and title 
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IN THE UNITED STATES DISTRICT COURT JUL 12 208 


Clerk, U.S. Dist 
FOR THE DISTRICT OF COLUMBIA Courts for the Distt of Aa 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH ` Case No. l- SE — @YO3 


Filed Under Seal 


AMENDED AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 
l. I make this affidavit in support of an application for a search warrant for | 
information associated with the following: 


a. The email account | by CSC Holdings (“Target 


Account 1”), described further in Attachment A. 


b. The Apple Account (including email) associated with = :i0:2i0c 


by Apple, Inc. (Target Account 2), described further in Attachment C. 

c. The email accoun fi vaintained by Windstream Communications 
(“Target Account 3”), described further in Attachment E. 

The information to be disclosed by CSC Holdings, Apple, Inc., and Windstream 
Communications (“the Providers”) and searched by the government is described in the following 
paragraphs and in Attachments A-F. This affidavit is made in support of an application for a 
search va under 18 U.S.C. §§ 2703(a), 2703(b)(1)(A), and 2703(c)(1)(A). 

2. I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation 
(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and 


experience in investigating criminal and national security matters. 
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3. The facts in this affidavit come from my personal observations, my training and 


experience, and information obtained from other agents and witnesses. This affidavit is intended ` 


to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4, Before the submission of this warrant application, the Special Counsel’s Office 
complied with all relevant Department of Justice policies, including the requirement for 
Departmental approval under the Department’s policy regarding obtaining information from 
members of the news media, 28 C.F.R. 50.10. 

5. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause b believe that the Target Accounts contain communications relevant to 
violations of 18 U.S.C. § 371 (conspiracy) and 18 U.S.C. § 1030 (unauthorized access of a 
protected computer). 

JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 

such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 2711(3)(A)G@). The offense conduct included activities in Washington: D.C., as detailed below, 
including in paragraph 19. 
SUMMARY 
7. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to “Get to 


Assange” at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” On or about July 


31,2016, STONE also instructed CORSI to have O R Julian 


2 
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ASSANGE. On or about August 2, 2016, CORSI responded to STONE that the “word is friend 
in embassy [ASSANGE] plans 2 more dumps. One shortly after I’m back. 2nd in October. 
Impact planned to be very damaging.... Time to let more than Podesta to be exposed as in bed w 
enemy if they are not ready to drop HRC.” After receipt of that message, on or about August 21, 
2016, using @RogerJStoneJR, Stone tweeted: “Trust me, it will soon the [sic] Podesta’s time in 
the barrel. #CrookedHillary.” 

8. Information disclosures subsequently occurred on or about the times CORSI 
predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the United 
States (“shortly after I’m back”), Guccifer 2.0 released hacked information related to the 
Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day 
the Washington Post published a breaking story about an Access Hollywood videotape of then- 
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked 
from the account of John Podesta. 

9. Furthermore, on the day of the Access Hollywood video disclosure, there were 
phone calls between STONE and CORSI after the Washingéen Post contacted STONE prior to 
publication. At approximately 11:00AM, the Washington Post received a tip regarding the 
Access Hollywood video. Approximately one hour later, shortly before noon, STONE received 
a call from the Washington Post. Approximately ninety minutes later, before 2:00 PM, STONE 
called CORSI and they spoke. Approximately forty minutes later, CORSI called STONE and the 
two spoke again at length. At approximately 4:00PM, the Washington Post published its story 
regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks tweeted out its 


first release of emails hacked from John Podesta. 
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PROBABLE CAUSE. 


A. Background on Relevant Individuals 
i. Roger STONE 
11. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign’”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. As 
described further below, STONE also maintained contact with individuals employed by the 
Campaign, including jcacatapeian chairman Paul MANAFORT and deputy chairman Rick 
GATES. 


ii. Jerome CORSI 


E E E ae 
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12. Jerome CORSI isa political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


| hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 


B. U.S. Intelligence Community (USIC) Assessment of Russian Government-Backed 
Hacking Activity during the 2016 Presidential Election 


E ees TETEE TAARAT 
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14. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 


the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following, with emphasis added: 

I5. The U.S. Intelligence Community (USIC) is confident that the Russian’ 
Government directed the recent compromises of emails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked emails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Rasni daecied efforts. These thefts and disclosures are 
intended to interfere with the US election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

16. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

17. “Russian President Vladimir Putin ordered an influence campaign in 2016 aimed 
at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 


18. The USIC also described, at a high level, some of the techniques that the Russian 
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government employed during its interference. The USIC summarized the efforts as a “Russian 
messaging strategy that blends covert intelligence operations—such as cyber activity—with 
overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, 
and paid social media users or ‘trolls.’” | 
19. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “{i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities to 
the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations senulted in 
the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” The GRU is the 
foreign military intelligence agency of the Russian Ministry of Defense, and is Russia’s largest 
foreign intelligence agency. 

20. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

21. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

| C. Additional Hacking Activity by Individuals Associated with the GRU 

22. The Special Counsel’s Office has determined that individuals associated with the 

GRU continued to engage in hacking activity related to the 2016 campaign through at least 


November 1, 2016. 


Se en ee ARRATERA ER. 
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23. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

24. Onor about September 4, 2016, individuals associated with the GRU stole the _ 
emails from a former White House advisor who was then save the Clinton Campaign. These 
emails were later post on DCLeaks. 

25. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

D. Roger Stone’s Public Interactions with Guccifer 2.0 and WikiLeaks 

26. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the apes: thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

27. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 

the DNC. 


28. On August 5, 2016, Roger Stone published an article on Breitbart.com entitled, 


8 
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“Dear Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t 
seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of 
Guccifer 2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in 
the article and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains 
who he is and why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a 
fateful and wise decision. He went to WikiLeaks with the DNC files and the rest is history. Now 
the world would see for themselves how the Democrats had rigged the game.” 

29. On August 8, 2016, Stone addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
Assange to Russia Today (RT) several days earlier about an upcoming “October Surprise” aimed 
at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard to the 
October surprise, what would be your forecast on that given what Julian Assange has intimated 
he’s going to do?” Stone responded: “Well, it could be any number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, Stone 
clarified that while he was not personally in touch with Assange, he had a close friend who 
served as.an intermediary. 

30. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the Democratic Congressional Campaign 
Committee (DCCC). 

31. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 


2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
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Twitter account was reinstated. 

32. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back,” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

33. On August 18, 2016, Paul Manafort, Stone’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that Manafort had worked with a Washington D.C.-based lobbying firms to Hek U.S. policy 
toward Ukraine. 

34. On August 21, 2016, using @RogerJStoneJR, Stone tweeted stating: “Trust me, it 
will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that 
same day, Stone reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[Assange], the public [could] expect to see much imo from the exiled whistleblower in the form 
of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 

Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

35. On September 16, 2016 Stone said in a radio interview with Boston Herald Radio 
that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly basis 
fairly soon. And that of course will answer the question as to what exactly what was erased on 
that email server.” 

36. On Sadiy October 1, 2016, using @RogerJStoneJr, Stone Tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 


37. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
10 
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tweeted Bote an announcement Julian Assange had scheduled for the next day from the 
balcony of the Ecuadoran Embassy in London. On the day of the Assange announcement — 
which was part of WikiLeaks’ 10-year anniversary celebration — Stone told Infowars that his 
intermediary described this release as the “mother load.” On October 5, 2016, Stone used 
@RogerJ StoneJr to tweet: “Payload coming. #Lockthemup.” 

38. On Friday, October 7, 2016, at approximately 4:03 P.M., the Washington Post 
published j article containing a recorded conversation from a 2005 Access Hollywood ahot in 
which Mr. Trump had made a series of lewd remarks. 

39. Approximately a half hour later, at 4:32 P.M., WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account, 

40. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, John Podesta — referring back to Stone’s August 
21, 2016 C-SPAN and Twitter references — argued publicly that “Jit is] a reasonable asainn 
to - or at least a reasonable conclusion - that [Stone] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[Stone].” Commenting to the NBC News, Stone responded: “I have never met or spoken with 
Assange, we have a mutual friend who’s traveled to London several times, and everything I 
know is through that channel of communications. I’m not implying I have any influence with 
him or that I have advanced knowledge of the specifics of what he is going to do. I do believe he 
has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, thought were 


deleted. I hear that through my emissary.” 
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41. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between Stone and WikiLeaks. The same article quoted 
Stone as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 


- limited things I did predict (Oct disclosures) all came true.” 


E. Roger Stone’s Private Twitter Direct Messages with WikiLeaks and Julian Assange. 


42. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStonedr. 

43. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs yon may want to rexamine the 
strategy of attacking me- cordially R.” 

44, Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

45. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you're lying. Your 


operation leaks like a sieve. You need to figure out who your friends are.” 
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46.  Onor about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

47. In addition, @RogerJStoneJr also exchanged direct messages with Julian 
Assange, the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly 
messaged @JulianAssange, an address associated with Julian Assange in numerous public 
reports, stating: “Still nonsense. As a journalist it doesn't matter where you get information only 
that it is accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards, With the tramped-up sexual assault 
charges dropped I don't know of any crime you need to be pardoned for - best regards. R.” That 
same day, @J olani ceni responded: “Between CIA and DoJ they're doing quite a lot. On the 
DoJ side that's coming most strongly from those obsessed with taking down Trump trying to > | 
squeeze us into a deal.” 

48. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 


F. CORSI’s Communications with STONE, ee... Others Regarding 
Forthcoming Leaks. 
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49. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE’s RS D On October 


17, 2017, Chief Judge Beryl A. Howell issued a search warrant for STONE’ sii address, 

BE o- 0: about December 19, 2017 Chief Judge Beryl A. Howell issued a 
search warrant for O N account. On or about March 14, 2018, Chief Judee Bayi 
A. Howell issued a search warrant for STONE’s iCloud account. Information recovered pursuant 
to those search warrants indicated the following: 

50. On or about May 15, 201 a ooo emailed CORSI at Target Account 3: 
“Here is my flight schedule. Need to get something confirmed now . . . .” CORSI responded, “I 
copied Roger Stone so he knows your availability to meet Manafort and DT this coming week.” 
CORSI appears to have forwarded the message to STONE, who replied to CORSI that, “May 
meet Manafort -guarantee nothing.” 

51. On or about May 16, 2016, BE A CORSI on Target Account 3: 
“Outside of Wednesday 2-4 ... lam open. Do you have times for meeting on other things? 
Flexible re DJT. How about the head of finance for them?” CORSI responded, “I will work on 
other meetings today” EE price, “Do you [want] me to bring you anything from the 
Old Country? I have a meeting now from 2-6 on Wednesday. Open all other times!!!” 

52. On or about May 18, 2016, CORSI, using Target Account 3, emailed STONE 


with the Title, “Roger -- why don't you look this over before I send it m believe that 


es A 
OO I did manage to see Mr. Trump for a few minutes today as we were 


waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 


was very cordial. He would look for this memo from you this afternoon.” 
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53. On July 25, 2016, STONE sent an email to CORSI at Target Account 1 with the 
subject line, “Get to Assange.” The body of the message read: “Get to Assange [a]t Ecuadorian 
Embassy in London and get the pending WikiLeaks emails...they deal with Foundation, 
allegedly.” 

54. On or about July 31, 2016, STONE emailed CORSI at Target Account 1 with the 
subject line, “Call me MON.” The body of the email read: TR should see Assange[.] 
= should find Bernie [SJanders brother who called Bill a Rapist — turn him for Trumpf.] 
| find =a or more proof of Bill getting kicked out.” 

55. On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE using Target Account 1, 
“Word is friend in embassy plans 2 more dumps. One shortly after I'm back. 2nd in Oct. Impact 
planned to be very damaging. Signs are Fox will have me on mid-Aug. more post Ailes shakeup 
underway. Expect Shine to surface victor, for now. Post-DNC bump for HRC an artifact of 
rigged polling. Won't last. I expect presidential campaign to get serious starting Sept. Still in pre- 
season games. Time to let more than Podesta to be exposed as in bed w enemy if they are not 
ready to drop HRC. That appears to be the game hackers are now about. Would not hurt to start 
suggesting HRC old, memory bad, has stroke -- neither he nor she well. I expect that much of 
next dump focus, setting stage for Foundation debacle.” Investigators believe that CORSI’s 
reference to a “friend in embassy [who] plans 2 more dumps” refers to Julian ASSANGE, the 
founder of WikiLeaks, who resided in Ecuador’s London Embassy in 2016. 

56. On or about August 5, JG G associate of STONE’s, emailed 
him a link to a poll indicating that Clinton led Trump by 15 points. STONE responded “enjoy it 


while u can[.] I dined with my new pal Julian Assange last night. subsequently 
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stated to investigators that, around the same time, STONE told him he had gone to London to 
meet ASSANGE (so stated that in 2018, MM old STONE he would be 
interviewed by the FBI and would have to divulge the TEE about meeting ASSANGE. 
STONE tola: was joking and had not actually met Assange. 


57. Onor about August 15, 2016, CORSI messaged STONE using Target Account 


3: “Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it’s not | 


over yet. More to come than anyone realizes. Won’t really get started until after Labor Day. Pm 
in NYC this week. Jerry.” 

58. On or about August 31, 2016, CORSI using Target Account 1 emailed STONE: 
“Did you get the PODESTA yane STONE replied “yes.” 

59. Onor about August 31, 2016, CORSI, using Target Account 2, messaged 
STONE, “Podesta paid $180k to invest in Uranium One — was hired by Rosatom in Giustra 
scandal. Podesta now under FBI investigation — tied to Ukraine Yanukovych — Panama papers 
reveals Podesta hired by S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to 
Russia undermine Clinton false narrative attempting to tie Trump to Putin.” 

60. On or about September 6, 2016, CORSI emailed STONE using Target Account 
3: “Roger|,] Is NY Post going to use the Pedesta [sic] stuff?” 

61. Onor about September 24, 2016 R CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded using Target 
Account 3, “We have secure back channel through Roger. I saw him again in NYC last Friday 
and spoke to him about it again today.” rote back, “Awaiting secret file. 
Explosive... Hope you are well. Can't wait for the debate. Channeling Reagan, I hope!” CORSI 


responded, “Keep me posted about file[.]” In a subsequent meeting with investigators, 
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RER this conversation concerned possible derogatory information he was trying 
to obtain from Turkey. 

62. On or about October 3, 2016, an associate of STONE emailed STONE and asked: 
“Assange — what’s he got? Hope it’s good.” Stone wrote back, “It is. I’d tell Bannon but he 
doesn’t call me back. My book on the TRUMP campaign will be out in Jan. Many scores will be 
settled.” The associate forwarded the email to Steve BANNON and wrote: “You should call 
Roger. See below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to 
worry about.” The associate responded, “Well clearly he knows what Assange has. Pd say that’s 
important.” | 

63. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed. that the U.S. election-related documents would all come out before Election Day. 

64. Onor about October 4, 2016, CORSI messaged STONE using Target Account 2, 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

65. That same day, BANNON emailed STONE, “What was that this morning???” 
STONE replied, “Fear. Serious security concern. He thinks they are going to kill him and the 
London police are standing done [sic]. “ BANNON wrote back, “He didn’t cut deal w/ 


clintons???” Stone replied, “Don't think so BUT his lawyer fill is a big democrat.” 
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© 66. When BANNON spoke with investigators during a voluntary proffer on February 
14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was about 
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE 
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. 


67. According to a publicly available news article,! at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same article, 
“Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage from a 
2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, calling 
Trump’s campaign, ‘Access Hollywood’ and NBC for reaction.” l 

68. According to phone records ————— = _ 4 at approximately 
11:27 AM, CORSI placed a call to STONE which STONE did not answer. 

69. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

70. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

71.  Atapproximately 2:18PM, CORSI called STONE and the two spoke for 


approximately twenty minutes. 


 hitps://www. washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was- 
on/2016/10/07/3 14747 14-8ce5-1 1e6-875e-2c] bfe943b66_ story. html 
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72. At approximately 4:00PM, the Washington Post published a story regarding the 


Access Hollywood tape. > 


73. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, when CORSI emailed STONE on Target Account 1, he wrote “T 


expect that much of next dump focus, setting stage for Foundation debacle.” 


74. At approximately 6:2 PM sent STONE an email titled, 
“WikiLeaks — The Podesta Emails” with a link to the newly-released Podesta emails. 
Approximately ten minutes later, STONE forwarded o ON to CORSI at Target 
Account 1 without comment. STONE does not appear to have forwarded the email to any other 


individual. 


H. STONE Requests to CORSI for “SOMETHING” to Post About Podesta After 
STONE Is Accused of Advance Knowledge of the Leak 


75. On or about October 8, 2016, STONE messaged CORSI at Target Account 2, 
“Lunch postponed — have to go see T.” CORSI responded to STONE, “Ok. I understand.” 
Approximately twenty minutes later, CORSI texted, “Clintons know they will lose a week of 
Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs speech 
comments, attacking bad job numbers.” 

76. On or about Wednesday, October 12, 2016, at approximately 8:17 EDT, STONE 
emailed CORSI at Target Account 1, asking him to “send me your best podesta links.” STONE 
emailed CORSI at approximately 8:$$ EDT, “need your BEST podesta pieces.” CORSI wrote 


back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on Podesta is 
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complicated. Two articles in length. I can give you in raw form the stuff I got in Russian 
translated but to write it up so it's easy to understand will take weekend. Your choice?” 
77. On or about that same day October 12, 2016, Podesta accused STONE of having 


advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI, 


using Target Account 1, emailed STONE with a subject line “Podesta talking points.” Attached 


to the email was a file labeled, “ROGER STONE podesta talking points Oct 12 2016.docx.” The 
“talking points” included the statement that “Podesta is at the heart of a Russian-government . 
money laundering operation that benefits financially Podesta personally and the Clintons through 
the Clinton Foundation.” 

78. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the BE count, “Got them and used them.” 

79. Onor about Thursday, October 13, 2016, CORSI, using Target Account 8. 
emailed STONE: “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI wrote 
back to STONE, “Pll give you one more — NOBODY YET HAS THIS[:] It looks to me like 

EOE maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] onc 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 


Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 
80. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email with the Subject, “ROGER STONE article RUSSIAN MAFIA STYLE 
MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN PODESTA.” The text 
stated: “Roger[,] You are free to publish this under your own name.” That same day, STONE 
posted a blog post with the title, “Russian Mafia money laundering, the Clinton Foundation and 
John Podesta.” In that post, STONE wrote, “although I have had some back-channel 
communications with Wikileaks I had no advance notice about the hacking of Mr. Podesta nor I 
have I ever received documents or.data from Wikileaks.” The post then asked, “Just how much 
money did i. a controversial Russian billionaire investor with ties to the 
Viadimir Putin and the Russian government, launder through Metcombank, a Russian regional 
bank owned 99.978 percent by =a with the money transferred via Deutsche Bank and 
Trust Company Americas in New York City, with the money ending up in a private bank 
account in the Bank of America that is operated by the Clinton Foundation?” 
` 81. Onor about October 14, 2016, CORSI sent a message using Target Account 2 to 
STONE, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 
82. On or about October 17, 2016, CORSI messaged STONE using Target Account 
2, “On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 


21 


(ser 


Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 30 of 57 


83.  Onor about October 17, 2016, CORSI, using Target Account 1, emailed STONE 
with the subject, “Fwd: ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” 
and forwarded an email with the header information stripped out, showing only the body text. 
The email read, “Yes[.] I figured this. Assange is threatening Kerry, Ecuador and U.K. He will 
drop the goods on them if they move to extradite him. My guess is that he has a set of dead man 
files that include Hillary. It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if 
Trump speaks out to save him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If 
HRC wins, Assange can kiss his life away. Interesting gambit Assange has to play out. He’s 
called Podesta’s bluff and raised him the election.” 

— 84. ~~ On or about October 18, 2016, CORSI messaged STONE using Target Account 
2, “Pls call. Important.” 

85. . On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

86. | Onor about November 8, 2016, the United States presidential election took place. 

87. On or about November 9, 2016, CORSI, using Target Account 2, messaged 
STONE, “Congratulations, Roger. He could not have done it without you.” 

88. On or about November 10, 2016, CORSI messaged STONE using Target 
Account 2, “Are you available to talk on phone?” Sever minutes later, CORSI messaged, “I’m 


in London. Have some interesting news for you.” 
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BACKGROUND CONCERNING EMAIL 

96. In my training and experience, I have learned the Providers provide a variety of 
on-line services, including electronic mail (“email”) to the public. The Providers allow 
subscribers to obtain email accounts at the domain names identified in the email address 
contained in kitan A and C. Subscribers obtain an account by registering with the 
Providers. During the registration process, the Providers ask subscribers to provide basic 
personal information. Therefore, the computers of the Providers are likely to contain stored 
electronic communications (including retrieved and unretrieved email) for their subscribers and 
information concerning subscribers and their use of services, such as account access information, 
email transaction information, and account application information. In my training and 
experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

97. In my training and experience, email Providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

98. In my training and experience, email Providers typically retain certain 


transactional information about the creation and use of each account on their systems. This 
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information can include the date on which the account was created, the length of service, records 
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account 
(including whether the account is inactive or closed), the methods used to connect to the account 
(such as logging into the account via the Providers’ website), and other log files that reflect 
usage of the account. In addition, email Providers often have records of the Internet Protocol 
address (“IP address”) used to register the account and the IP addresses associated with particular 
logins to the account. Because every device that connects to the Internet must use an IP address, 
IP address information bai help to identify which computers or other devices were used to access 
the email account. 

99. In my training and experience, in some cases, email account users will 
communicate directly with an email service Providers about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. Email Providers 
typically retain records about such communications, including records of contacts between the 
user and the Providers’ support services, as well as records of any actions taken by the Providers 
or user as a result of the communications. In my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. 

100. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 


the account. This “user attribution” evidence is analogous to the search for “indicia of 
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` occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, 
information maintained by the email Providers can show how and when the account was 
accessed or used. For example, as described below, email Providers typically log the Internet 
Protocol (IP) addresses from which users access the email account, along with the time and date 
of that access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time (e.g., location information integrated into an image or video sent 
via n, Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime (e.g., 
communications relating to the crime), or consciousness of guilt (e.g., deleting communications 
in an effort to conceal them from law enforcement). 
101. In my training and experience, information such as search history can help to l 
show the state of mind of an individual at the time the search was paca well as the 
individuals potential advance knowledge of events, as they saith to see if the anticipated event 


has occurred. 
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INFORMATION REGARDING APPLE ID AND iCLOUD? 


102. Apple isa United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 


the Mac OS operating system. 


103. Apple provides a variety of services that can be accessed from Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

E Apple provides email service to its users through email addresses at the 
domain names mac.ċom, me.com, and icloud.com. 

e iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (“iMessages”) 
containing text, jotos; videos, locations, and contacts, while FaceTime enables those tae to 
conduct video calls, 

e iCloud is a file hosting, storage, and sharing service provided by Apple. 


iCloud can be utilized through numerous iCloud-connected services, and can also be used to 


store iOS device backups and data associated with third-party apps. 


2 The information in this section is based on information published by Apple on its website, including, but 
not limited to, the following document and webpages: “U.S. Law Enforcement Legal Process Guidelines,” available 
at http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf “Create and start using an Apple ID,” 
available at https://support.apple.com/en-us/HT203993; “iCloud,” available at http://Awww.apple.com/icloud/; “What 
does iCloud back up?,” available at https://support.apple.com/kb/PH12519; “iOS Security,” available at 


hitps://www.apple.com/business/docs/iOS Security Guide.pdf, and “iCloud: How Can I Use iCloud?,” available at 
https://support.apple.com/kb/PH26502. 
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° . iCloud-connected iyice allow users to ede. store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and 
manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 
to share those images and videos with other Apple subscribers. iCloud Drive can be used to 
ae presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable 
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers 
on all of the user’s Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers, 


Keynote, and Notes), enables iCloud to be used to create, store, and share documents, 


spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and 


passwords, credit card information, and Wi-Fi network information synchronized across multiple 
Apple devices. | 

° Game Center, Apple’s social T network, allows users of Apple 
devices to play and share games with each other. 

° Find My iPhone allows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. Find My 
Friends allows owners of Apple devices to share locations.. 

° EA Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. | 

e App Store and iTunes Store are used to purchase and download digital 


content. iOS apps can be purchased and downloaded through App Store on iOS devices, or 
29 . 
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through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS. Additional digital content, including music, movies, and television shows, can be 
purchased through iTunes Store on iOS devices and on desktop and laptop computers running 


either Microsoft Windows or Mac OS. 


104. Apple services are accessed through the use of an “Apple ID,” an account created 


during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 
syncing mechanism. 

105. An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 
associated with an Apple ID by the user. 

106. Apple captures information associated with the creation and use of an Apple ID. ` 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers, The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgot” pages on 
Apple’s website. In addition, Apple captures the date on which the account was created, the 


length of service, records of log-in times and durations, the types of service utilized, the status of 
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the account (including whether the account is inactive or closed), the methods used to connect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access ` 
the account, and other log files that reflect usage of the account. 

107, Additional information is captured by Apple in connection with the use of an 
Apple ID to access certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 
invitation logs” for FaceTime calls, “query logs” for iMessage, and “mail logs” for activity over 
an Apple-provided email account. Records relating to the use of the Find My iPhone service, 
including connection logs and requests to remotely lock or erase a device, are also maintained by 
Apple. 

108. Apple also maintains information about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“ICCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, including the Media Access Control address (“MAC 
address”), the unique device identifier (“UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
aped when used to access services through icloud.com and apple.com. Apple also retains 


records related to communications between users and Apple customer service, including 
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communications regarding a particular Apple device or service, and the repair history for a 
device. 

109. Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, including: email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (Work and iCloud Drive); and 
web browser settings and Wi i network information (iCloud Tabs and iCloud Keychain). 
iCloud can also be used to store iOS device backups, which can contain a user’s photos and 
videos, iMessages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call history, contacts, calendar events, reminders, 
notes, app data and settings, Apple Watch backups, and other data. Records and data associated 
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an 
instant messaging service, can be configured to regularly back up a user’s instant messages on 
iCloud Drive. Some of this data is stored on Apple’s servers in an encrypted form but can 


nonetheless be decrypted by Apple. 


110. In my training and experience, evidence of who was using an Apple ID and from - 


where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each clement or, alternatively, to exclude the innocent from further 


suspicion. 
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INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 

111. Ll anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the accounts in Attachment A, C, and 
E and particularly described in Section I of Attachment B, D, and E. Upon receipt of the 
information described in Section I of Attachments B, D, and F, government-authorized persons 
will review that information to locate the items described in Section II of Attachment B, D, and 
F. The items identified in Attachments A-F will also be screened by reviewers not on the 
prosecution team to identify and filter out privileged material. 

CONCLUSION 
112. Based on the forgoing, I request that the Court issue the proposed search warrant. 
113. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 


required for the service or execution of this warrant. 
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REQUEST FOR SEALING 


114. I further request that the Court order that all papers in support of this dpplication: 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Andrew Mitchell 
Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this VA A day of July, 2018. 


O SALAK 
The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the following email account: 


Í. 
that is stored at premises owned, maintained, controlled, or operated by CSC Holdings, LLC, 


1111 Stewart Avenue, Bethpage, NY 11714. 
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ATTACHMENT B 
. Particular Things to be Seized 


Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 


a. 


The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


All existing printouts from original storage of all of the electronic mail described above 
in Section LA. above; 


All internet search data including all queries and location data; 


All transactional information of all activity of the account described above in Section LA, 


including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 


All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 


Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 


All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 
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II. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15, 2016 to November 10, 2016. 
including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Roger Stone, vias Assange, or 
any individual associated with the Trump Campaign; 


All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


c. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


d. Evidence of the times the account was used; 


e. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


f. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts;. 


g. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


h. All existing printouts from original storage which concern the categories identified i in 
subsection II.A; 
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ATTACHMENT C 


Property to be Searched 


This warrant applies to information associated with the following Apple account: 


i 
i 
: È 


that is stored at premises owned, maintained, controlled, or operated by Apple, Inc., located at 


| 
| 
| 


One Apple Park Way, Cupertino, California 95014. 


EEEE EAI ANST 
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ATACHMENT D 
Particular Things to be Seized 


I. Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Apple, regardless of whether such information is located within or outside — 


of the United States, including any messages, records, files, logs, or information that have been 

deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(H), Apple is required to disclose the following information to the government, 

in unencrypted form whenever available, for each account or identifier listed in Attachment A: 


a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, . 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 


b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers “UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities ey and International Mobile 
Station Equipment Identities (“IMEI”); 


c.- The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted. 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 


d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual JP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 


f. All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes ` 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 


g- All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 


h. All records pertaining to the types of service used, 


i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 


j. All files, keys, or other information necessary to decrypt any data produced in an 


encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 


40 


Case 1:19-mc-00029-CRC Document 29-10 Filed 04/28/20 Page 49 of 57 


II. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15, 2016 to November 10, 2016. 


including: 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to hacked material; 


_ All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Roger Stone, eee Julian 


Assange, or any individual associated with the Tramp Campaign; 


All images, messages, communications, calendar entries, search terms, and 


contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


Communication, information, documentation and records relating to who created, 
used, or communicated with the account or identifier, including records about 
their identities and whereabouts; ’ 


Evidence of the times the account was used; 


All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 


. Passwords and encryption keys, and other access information that may be 


necessary to access the account and other associated accounts; 


Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


All existing printouts from original storage which concern the categories 
identified in subsection II.A; and 


All “address books” or other lists of contacts. 
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ATTACHMENT E i . | 
Property to be Searched 
This warrant applies to information associated with the following email account: | 


that is stored at premises owned, maintained, controlled, or operated by Windstream 


| 
iE 
a 
iE 
i 
| 


Communications, Inc, with offices located at 11001 Executive Center Drive, Little Rock, 


Arkansas, 72211. | 
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ATTACHMENT F » 
Particular Things to be Seized 


Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment E: 


a. 


The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 


All internet search data including all queries and location data; 


All transactional information of all activity of the account described above in Section LA, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 


All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 


Records or other information regarding the identification of the account described above 
in Section LA, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 


All records indicating the services available to subscribers of the electronic mail address 
described above in Attachment E; 
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i. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 1030 (fraud 
and related activities in connection with computers and 18 U.S.C. § 371 (conspiracy to commit 
an offense against the United States) for the period from June 15, 2016 to November 10, 2016. 
including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Roger Stone, GN Assange, or 
any individual associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


i. All existing printouts from original storage which concern the categories identified 
above; 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02403 
INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A. 

Assign. Date : 7/12/2018 

Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non- 

disclosure, the proposed Order would direct csc Holdings, an electronic communication and/or 


remote computing services provider headquartered in Bethpage, NY not to notify any other person 


(except attorneys for CSC Holdings for the purpose of receiving legal advice) of the existence or 


content of the Warrant for a period of one year or until further order of the Court. 


JURISDICTION AND LEGAL BACKGROUND 

1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling P interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 


“district court of the United States . . . that — has jurisdiction over the offense being investigated.” 
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18 U.S.C. $ 2711(3)(A)(). As discussed fully below, acts or omissions in furtherance of the 

offense under investigation occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). CSC Holdings provides an “electronic communications service,” as defined in 
18 U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how CSC Holdings may 
be compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(1)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4, The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 
notification. In relevant part, Section 2705(b) provides as follows:! 

(b) Preclusion of notice to subject of governmental access. — A governmental 

entity acting under section 2703 . . . may apply to a court for an order commanding 

a provider of electronic communications service or remote computing service to 

whom a warrant, subpoena, or court order is directed, for such period as the court 

deems appropriate, not to notify any other person of the existence of the warrant, 

subpoena, or court order. The court shall enter such an order if it determines that 

there is reason to believe that notification of the existence of the warrant, subpoena, 

or court order will result in— 


(1) endangering the life or physical safety of an individual; 
(2) flight from prosecution; 


! Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 
18 U.S:C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 


requisite showing about potential consequences of notification: 


The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 

` government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 


In re Application for Order of Nondisclosure Pursuant to 18 USC $ 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). | 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command CSC Holdings not to notify any other person (except attorneys for CSC Holdings for 
the purpose of receiving legal advice) of the existence of the Subpoena for a period of one year or 
until further order of the Court. 


FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. At the present time, law enforcement officers of the FBI are conducting an 
investigation into violations related to 18 U.S.C. §-1030 (unauthorized access of a protected 
computer) and 18 U.S.C. § 371 (conspiracy) arising out of the conduct of Roger Stone, Jerome 
Corsi, and others. It does not appear that Stone and Corsi are currently aware of the full nature and 
scope of the ongoing FBI DN Disclosure of this warrant to Corsi could lead him to 


destroy evidence or notify others who may delete information relevant to the investigation. 
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. REQUEST FOR SEALING AND NON-DISCLOSURE 


7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that CSC Holdings and its employees be directed not to notify any other person 


of the existence or content of the Warrant (except attorneys for CSC Holdings for the purpose of 


receiving legal advice) for a period of one year or until further order of the Court. Such an order’ ~ 


is appropriate because the Warrant relates to an ongoing criminal investigation, the full scope of 
which is neither public nor known to the targets of the investigation, and its disclosure may alert 
these targets to the ongoing investigation and its scope. Once alerted to this investigation, potential 
targets would be immediately prompted to destroy or conceal incriminating evidence, alter their 
operational tactics to avoid future detection, and otherwise take steps to undermine the 
investigation and avoid future prosecution. In particular, given that they are known to use 
electronic communication and remote computing services, the potential target could quickly and 
easily destroy or encrypt digital evidence relating to tele criminal activity. E 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, ie Government will notify the Court and seek appropriate relief. 

9, There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investi gation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 


§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 


RETRETE 


RTT TTT 
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compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with CSC Holdings the United States is aware that, absent 
a court order under Section 2705(b) commanding CSC Holdings not to notify anyone about a legal 
request, it is CSC Holdings’s policy and practice, upon receipt of a warrant seeking the contents 
of electronically stored wire or electronic communications for a certain account, to notify the 
subscriber or customer of the existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
CSC Holdings not to notify any other person of the existence or contents of the above-captioned 
warrant (except attorneys for CSC Holdings for the purpose of receiving legal advice) for a period 
of one year or until further order of the Court, 

Respectfully submitted, 


ROBERT S. MUELLER, III 
Special Counsel 


Dated: 7/1 2ag By: [te 
Aaron S.J. Zeli 
The Special 

(202)-5 14-0637 


nsel’s Office 


ea 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 
for the 
District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH THREE 


Case: 4:18-sc-02524 
Assigned To : Howell, Beryl A. 


ian. Date : 7/27/201 8 
ae Search & Seizure Warrant 


Sea ae a 


ACCOUNT STORED AT PREMISES Description: 
CONTROLLED BY GOOGLE 
SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I] find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before August 10, 2018 (not to exceed 14 days) 
in the daytime 6:00 a.m. to 10:00 p.m. Vat any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 
(United States Magistrate Judge) 


© Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 USE. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

ao for days (not to exceed 30) O until, the facts justifying, the later specific date of 


Date and time issued: Ha F/ Br g ef 5 tool SEZ fF. V LLA 


Judge's signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Case No.: Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 


Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 3 of 38 


ATTACHMENT A 
Property to be Searched 
This warrant applies to search history information associated with the following accounts 
stored at premises owned, maintained, controlled, or operated by Google, LLC, in Mountain 


View, California: 
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ATTACHMENT B 
Particular Things to be Seized 
L Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 


Attachment A: 


a. All search history information associated with each account. 


. Il. Information to be Seized by Law Enforcement Personnel 
Any and all records that relate in any way to the accounts described in Attachment A 

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), 
and 52 U.S.C. § 30121 (foreign contribution ban) for the period from June 2015 to the present, 
including: 

a. All records, information, documents or tangible materials that relate in any way to 

communications regarding hacking, release of hacked material, communications with 

persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 


communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 
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b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Roger Stone, Julian Assange, or 
any individual associated with the Trump Campaign; 


e. Evidence indicating the account owner’s state of mind as it relates to the crimes under 
investigation; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Information, documentation and records relating to who created, used, or communicated 
with the account or identifier concerning the messages identified above, including records 
about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All evidence of wiping software, encryption or other methods to avoid detection by law 
enforcement; 


g. Evidence of passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 


h. Evidence of credit card and other financial information, including but not limited to, bills 
and payment records evidencing ownership of the subject account; 


I. Review Protocols 


Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DistRicTCourr FILED 


for the JUL 27 2018 
District of Columbia Clerk, U.S. District & Bankruptcy 
Courts for the District of Columbia 
In the Matter of the Search of j 
Briefly i i the pie to bs searched j) Case: 1:1 8-sc-02524 
or identify the person by name and address) i : 
INFORMATION ASSOCIATED WITH THREE ACCOUNTS} i ci To : Howell, Beryl A. 
STORED AT PREMISES CONTROLLED BY GOOGLE 4 ssign. Date : 7/27/2018 
j Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property to be searched and give its location): 


See Attachment A 


located in the Northern 
person or describe the property to be seized): 


See Attachment B 


District of California , there is now concealed (identify the 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
{í evidence of a crime; 
ow contraband, fruits of crime, or other items illegally possessed; 
& property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. §§ 2, 3, 4, 371 Aiding & Abetting, Accessory after the Fact, Misprision of a Felony, Conspiracy 


18 U.S.C. §§ 1030, 1343, 1349 Unauthorized Access of Protected Computer, Wire Fraud, Wire Fraud Conspiracy 
52 U.S.C. § 30121 Foreign Contribution Ban 


The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 
O Delayed notice of days (give exact ending date if more than 30 days: 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


) is requested 


Reviewed by AUSA/SAUSA: Applicant’s signature 
Kyle R. Freeny (ASC) z Andrew Mitchell, Special Agent, FBI 
Printed name and title 


Sworn to before me and signed in my presence. 


Date: 2 /, pa ( F; ZAF A EFIE. hed. SO f 


Jildgé's signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 


City and state: Washington, D.C. 
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P IL ie 
JUL 27 ae 
Clark, U.S, vistrlot & Dankruptcy 
IN THE UNITED STATES DISTRICT COURT Courts for tha District of Columbia 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-0 
INFORMATION ASSOCIATED WITH Assigned To : H rts 
THREE ACCOUNTS STORED AT Assign. Date - Rosi Beryl A. 


PREMISES CONTROLLED BY GOOGLE Description: S = wok 
ae ——_ Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 


L I make this affidavit in support of an application for a search warrant for search 


history information associated with the following Google accounts =a 


premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a business 
with offices located at 1600 Amphitheatre Parkway, Mountain View, CA 94043. The 
information to be disclosed by Google and searched by the government is described in the 
following paragraphs and in Attachments A and B. 

Qe I am a Special Agent with the Federal Bureau of Investigation (FBI), and have 
been since 2011. As a Special Agent of the FBI, I have received training and experience in 
investigating criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 


there is probable cause to believe that the Target Accounts contain information relevant to 
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violations of 18 U.S.C. § 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18 
U.S.C. § 4 (misprision of a felony); 18 U.S.C. § 371 (conspiracy); 18 U.S.C. § 1030 
(unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S.C. § 1349 
(attempt and conspiracy to commit wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban) 
(the “Subject Offenses”). 
JURISDICTION 

A This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 2711(3)(A)(). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraph 19. 

SUMMARY 

6. The Special Counsel’s Office, with FBI’s assistance, is investigating the Russian 
government’s efforts to interfere in the 2016 presidential election, as well as any links and/or 
coordination between the Russian government and individuals associated with the campaign of 
President Donald Trump. This includes investigating Roger Stone (STONE) and others known 
and unknown, in connection with the hacking of email accounts associated with the Democratic 
National Committee (DNC), Democratic Congressional Campaign Committee (DCCC), and 
individuals involved in the presidential campaign of Hillary Clinton, as well as the subsequent 
dissemination of hacked materials via the persona Guccifer 2.0 and the organization WikiLeaks, 


among others. 


Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 9 of 38 


Te On or about July 25, 2016, STONE emailed Jerome CORSI to “Get to Assange” 
at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” On or about July 31, 2016, 
STONE also instructed CORSI to hav o contact Julian ASSANGE. On or 
about August 2, 2016, CORSI responded to STONE that the “word is friend in embassy 
[ASSANGE] plans 2 more dumps. One shortly after Pm back. 2nd in October. Impact planned 
to be very damaging.... Time to let more than Podesta to be exposed as in bed w enemy if they 
are not ready to drop HRC.” After receipt of that message, on or about August 21, 2016, using 
@RogerJStoneJR, Stone tweeted: “Trust me, it will soon the [sic] Podesta’s time in the barrel. 
#CrookedHillary.” 

8. Information disclosures subsequently occurred on or about the times CORSI 
predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the United 
States (“shortly after I’m back”), Guccifer 2.0 released hacked information related to the DCCC. 
On or about October 7, 2016, the day the Washington Post published a breaking story about an 
Access Hollywood videotape of then-candidate Trump making disparaging remarks about 
women, WikiLeaks released emails hacked from the account of John Podesta. 

9. Furthermore, on the day of the Access Hollywood video disclosure, there were 
phone calls between STONE and CORSI after the Washington Post contacted STONE prior to 
publication. At approximately 11:00AM, the Washington Post received a tip regarding the 
Access Hollywood video. Approximately one hour later, shortly before noon, STONE received 
a call from the Washington Post. Approximately ninety minutes later, before 2:00 PM, STONE 
called CORSI and they spoke. Approximately forty minutes later, CORSI called STONE and the 


two spoke again at length. At approximately 4:00PM, the Washington Post published its story 
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regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks tweeted out its 


first release of emails hacked from John Podesta. 


PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 
IL. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. As 


described further below, STONE also maintained contact with individuals employed by the 
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Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick 
GATES. 
ii. Jerome CORSI 

12; Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 


contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


14. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 
the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following, with emphasis added: 


The U.S. Intelligence Community (USIC) is confident that the Russian Government 
directed the recent compromises of emails from US persons and institutions, including 
from US political organizations. The recent disclosures of alleged hacked emails on sites 
like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 
with the methods and motivations of Russian-directed efforts. These thefts and 
disclosures are intended to interfere with the US election process. Such activity is not 
new to Moscow—the Russians have used similar tactics and techniques across Europe 
and Eurasia, for example, to influence public opinion there. We believe, based on the 
scope and sensitivity of these efforts, that only Russia’s senior-most officials could have 
authorized these activities. 


DS; On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 


assessed the following: 


[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 


16. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 


as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
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activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

17.. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

18. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

19.. Gucecifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

20. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

21. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 


used three new accounts with the same cloud computing service to move the “snapshots” to 
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those accounts. 

2D On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

23, On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

24. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 
2016 presidential election, including conspiracy to commit authorized access to protected 
computers. (Case No. 1:18-cr-00125). 

C. Roger Stone’s Public Interactions with Guccifer 2.0 and WikiLeaks 

25: On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

26. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

27. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 


Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem ` 
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to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

28. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard 
to the October surprise, what would be your forecast on that given what Julian Assange has 
intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with ASSANGE. I believe the next tranche of his documents 
pertain to the Clinton Foundation but there’s no telling what the October surprise may be.” A 
few days later, STONE clarified that while he was not personally in touch with ASSANGE, he 
had a close friend who served as an intermediary. 

29. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

30. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 


31. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
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back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

32. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

33- On August 21, 2016, using @RogerJStoneJR, STONE tweeted stating: “Trust me, 
it will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview 
that same day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both 
his and [Assange], the public [could] expect to see much more from the exiled whistleblower in 
the form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think 
Julian Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. 
I believe that he is in possession of all of those emails that Huma Abedin and Chery! Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

34. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

35. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

36. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 


of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
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part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

37. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

38. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

39, WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, John Podesta — referring back to STONE’ s 
August 21, 2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable 
assumption to - or at least a reasonable conclusion - that [STONE] had advanced warning [of the 
release of his emails] and the Trump campaign had advanced warning about what Assange was 
going to do. I think there’s at least a reasonable belief that [Assange] may have passed this 
information on to [STONE].” Commenting to the NBC News, STONE responded: “I have never 
met or spoken with Assange, we have a mutual friend who’s traveled to London several times, 
and everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

40. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 


from an email address associated with WikiLeaks, denied that there was any backchannel 
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communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

41. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks.' The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

42. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

43. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you're lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

44. On or about November 9, 2016, one day after the presidential election, 


@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 


' On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter 


account @RogerJStoneJr. 
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@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

45. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with Julian Assange in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn't matter where you get information only that it is accurate 
and authentic. The New York Times printed the Pentagon Papers which were indisputably stolen 
from the government and the courts ruled it was legal to do so and refused to issue an order 
restraining the paper from publishing additional articles. If the US government moves on you I 
will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I 
don't know of any crime you need to be pardoned for - best regards. R.” That same day, 
@JulianAssange responded: “Between CIA and DoJ they're doing quite a lot. On the DoJ side 
that's coming most strongly from those obsessed with taking down Trump trying to squeeze us 
into a deal.” 

46. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with sro S and Others Regarding 
Forthcoming Leaks 


47. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE’s no TE On October 


17, 2017, Chief Judge Beryl A. Howell issued a search warrant for one of STONE 


13 


Case 1:19-mc-00029-CRC Document 29-11 Filed 04/28/20 Page 20 of 38 


addresses, i On or about December 19, 2017, Chief Judge Beryl A. 


Howell issued a search warrant for | email account. On or about March 14, 2018, 
Chief Judge Beryl A. Howell issued a search warrant for STONE’s iCloud account. Information 
recovered pursuant to those search warrants indicated the following: 

48. | Onor about May 15, 2016, MY emailed CORSI: “Here is my flight 
schedule. Need to get something confirmed now . .. .” CORSI responded, “I copied Roger Stone 
so he knows your availability to meet Manafort and DT this coming week.” CORSI appears to 


have forwarded the message to STONE ' i replied to CORSI that, 


“May meet Manafort -guarantee nothing.” 


49.  Onor about May 18, 2016, CORSI emailed STONE iii 


with the title, “Roger -- why don't you look this over before I send i I believe that 


CORSI wrote, 
and I did manage to see Mr. Trump for a few minutes today as we were’ 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

50. On July 25, 2016, STONE, vin i sent an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

SL On or about July 31, 2016, STONE, sin. emailed 
CORSI with the subject line, “Call me MON.” The body of the email read: o] should see 


Assangel should find Bernie [S]anders brother who called Bill a Rapist — turn him for 


Trump[.] n should sn or more proof of Bill getting kicked out.” 
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32; On or about August 2, 2016 (approximately 19 days before STONE publicly 

tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

O0 DR is friend in embassy plans 2 more dumps. One shortly after I'm 
back. 2nd in Oct. Impact planned to be very damaging. Signs are Fox will have me on mid-Aug. 
more post Ailes shakeup underway. Expect Shine to surface victor, for now. Post-DNC bump for 
HRC an artifact of rigged polling. Won't last. I expect presidential campaign to get serious 
starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed as in bed w 
enemy if they are not ready to drop HRC. That appears to be the game hackers are now about. 
Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I 
expect that much of next dump focus, setting stage for Foundation debacle.” Investigators 
believe that CORSI’s reference to a “friend in embassy [who] plans 2 more dumps” refers to 
Julian ASSANGE, the founder of WikiLeaks, who resided in Ecuador’s London Embassy in 
2016. 

SEA On or about August 5, 2016, ——— an associate of STONE’s, emailed 
STONE Foo The email contained a link to a poll indicating that Clinton 
led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last right.” subsequently stated to investigators that, around the same 
time, STONE told him he had gone to London to meet ASSANGE also stated that 
in 2018 A told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE i iii he was joking and 
had not actually met ASSANGE. 


54. On or about August 15, 2016, CORSI emailed STONE at 


E o “Give me a call today if you can. Despite MSM drumroll that HRC is 
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already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

55: On or about August 31, 2016, CORSI emailed STONE at 

C “Did you get the PODESTA writeup.” STONE replied “yes.” 

56. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

S7: On or about September 6, 2016, CORSI emailed STONE at 

E “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

58. On or about September 24, 2016, D emailed CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again ZSA | wrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators i indicated this conversation 
concerned possible derogatory information he was trying to obtain from Turkey. 

59. On or about October 3, 2016, an associate of STONE emailed STONE at 

toe and asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 
back, “It is. ’'d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 


BANNON and wrote: “You should call Roger. See below. You didn’t get from me.” BANNON 
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wrote back, “I’ve got important stuff to worry about.” The associate responded, “Well clearly he 
knows what Assange has. I’d say that’s important.” 

60. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

61. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

62. That same day, BANNON emailed STONE iii “What was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” Stone replied, “Don't think so BUT his DE | is a big 
democrat.” 

63. | When BANNON spoke with investigators during a voluntary proffer on February 
14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was about 
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE 
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 


BANNON had been hoping for releases of damaging information that morning. 
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F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. 


64. According to a publicly available news article,” at approximately 1 1AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same article, 
“Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage from a 
2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, calling 
Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

65. According to phone records OO : approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

66. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

67. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

68. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

69. At approximately 4:00PM, the Washington Post published a story regarding the 


Access Hollywood tape. 


70. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 


hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


2 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 1d74714-8ce5-1 1e6-875e-2c 1 bfe943b66_story.htm! 
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On or about August 2, 2016, when CORSI emailed STONE on © G 


wrote, “I expect that much of next dump focus, setting stage for Foundation debacle.” 


TE. At approximately 6:27PM, aa sent STONE an email titled, 


“WikiLeaks — The Podesta Emails,” with.a link to the newly-released Podesta emails. 
Approximately ten minutes later, STONE, vin O forwarded fi 
message to CORSI without comment. STONE does not appear to have forwarded the email to 


any other individual. 


G. STONE Requests to CORSI for “SOMETHING” to Post About Podesta After 
STONE Is Accused of Advance Knowledge of the Leak 


72. Onor about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 


numbers.” 

T3: On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
vin n emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?” 

74. On or about that same day, October 12, 2016, Podesta accused STONE of having 


advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
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“Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE podesta 
talking points Oct 12 2016.docx.” The “talking points” included the statement that “Podesta is at 
the heart of a Russian-government money laundering operation that benefits financially Podesta 
personally and the Clintons through the Clinton Foundation.” 

75. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

76. On or about Thursday, October 13, 2016, CORSI emailed STONE at 

ao, “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “TIl give you one more — NOBODY YET HAS THIS{[:] It looks to me 
like | RE maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once fa 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank{.] Pm working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

Mel On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email at = «i: the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 


JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
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name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money a a controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent Jo o o with the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

78. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

79, On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just landed 
JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important intel to 


share.” 
80. On or about October 17, 2016, CORSI emailed STONE at 
a with the subject, “Fwd: 
ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He wil! drop the goods on them if 


they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
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It’s what they used to call a ‘Mexican stand off].]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

81. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pls call. Important.” 

82. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

83. On or about November 8, 2016, the United States presidential election took place. 

84. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 

85. On or about November 10, 2016, CORSI messaged STONE at his iCloud 


account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 
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I. Evidence of Google Searches Relating to the Conduct Under Investigation 


92. The search history associated with the account fa which was 


obtained pursuant to search warrant, shows that STONE searched for terms that appear to be 


related to the DNC hack and the stolen emails, including his nexus thereto, while logged into the 


a For example, on or about October 13, 2016, STONE searched for the 
words “Roger Stone john Podesta.” The search history i appears to 


have been deleted between January 18, 2016, and July 23, 2016. 
93. During the course of its investigation, the FBI has also identified a series of 
searches that appear to relate to the personas Guccifer 2.0 and DCLeaks, which predate the 


public unveiling of those two personas. In particular, between May 17, 2016, and June 15, 2016 
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(prior to the publication of the Guccifer 2.0 WordPress blog), records from Google show that 
searches were conducted for the terms “dcleaks,” “guccifer,” and “guccifer june,” from IP 
addresses within one of two ranges: 172.56.26.0/24, 107.77.216.0/24.7 These IP ranges are 
assigned to T-Mobile USA, Inc., and AT&T Mobility LLC, respectively, and, according to 
Google, the searches were all conducted from Florida. On or about June 13, 2018, this Court 
issued a search warrant for information associated with these searches and, in particular, for the 
full search histories associated with the CookieIDs that conducted the search.’ As set forth in the 
affidavit submitted in support of that search warrant, IP logs obtained from Twitter showed that 
STONE used multiple IP addresses within the ranges 172.56.26.0/24 and 107.77.216.0/24 to log 
into his Twitter account @RogerJStoneJr. A Facebook account controlled by STONE also used 
an IP address within the range 172.56.26.0/24 on or about June 13, 2016, to purchase a Facebook 
advertisement. 

J. The Target Accounts 


94. Subscriber records show that, in addition 5 | STONE 


maintains at least two additional Google accounts registered in his name: 


a. O QE Account 1”) was created on July 28, 2016, 
and uses the recovery email address oo According to subscriber records, 


Target Account 1 was last accessed on July 5, 2017. Search warrant returns for 


O that on or about August 3, 2016, STONE sent an email from 


3 Google does not retain full IP addresses for searches conducted more than one year ago. The 
truncated IP addresses designated here as 107.77.216.0/24 and 17.56.26.0/24 each encompass a 
range of up to 256 IP addresses. 


4 Google assigns unique CookieIDs to searches conducted while a user is not logged into a 
Google account. All searches conducted from the same device and browser during a 24-hour 
window are associated with the same CookieID. 
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aaa to Target Account 1, with no subject, attaching what appears to be an 


advertisement for his book tour, entitled, “Clinton’s War on Women.” 

b. Po arget Account 2”) was created on or about 
October 26, 2016, and uses Target Account 1 as the recovery email. Target Account 2 was last 
accessed on or about August 8, 2017. 

95. The search of STONE’s Hotmail account indicates that STONE uses the address 


= -:..:.: Account 3”). For example, on or about June 27, 2016, Stone 


received an email in his BE ccount from the “Gmail Team” with the subject, 

“Your Gmail address has been created.” Subscriber records show that 
Target Account 3 was created on June 27, 2016, and is registered in the name of “Swash 
Buckler.” On or about April 16, 2018, this Court issued an order pursuant to 18 U.S.C. 

§ 2703(d) for non-content information associated with Target Account 3. Based on a review of 
the header information obtained from Google pursuant to that Order, it appears that STONE 
frequently used Target Account 3 to communicate with others via the classified advertisement 
website Craigslist.org (“Craigslist”). 

96. This warrant application seeks only search history for the Target Accounts; it 
does not seek the content of email communications to and from the Target Accounts.° Google 
maintains records of the Google searches that a user conducts while signed into a particular 
Google email account (provided the user has not disabled the retention of this information). In 


my training and experience, I know that users are often not aware of whether or not they are 


5 The government is also contemporaneously seeking an order pursuant to 18 U.S.C. § 2703(d) 
for non-content information associated with Target Accounts 1 and 2, including header 
information. 
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experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

99. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with a Google account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, an account’s search 
history may indicate who used or controlled the account at a relevant time. Further, information 
maintained by the email Providers can show how and when the account was accessed or used. 
Additionally, information stored in an account’s search history may indicate the geographic 
location of the account user at a particular time (e.g., location information integrated into an 
image or video sent via email). Lastly, stored electronic data, including search history 
information, may provide relevant insight into the email account owner’s state of mind as it 
relates to the offense under investigation. For example, information in the email account may 
indicate the owner’s motive and intent to commit a crime (e.g., searches relating to the crime), or 
consciousness of guilt (e.g., deleting search history in an effort to conceal information from law 
enforcement). 

FILTER REVIEW PROCEDURES 

100. Review of the items described in Attachment A and Attachment B will be 

conducted pursuant to established procedures designed to collect evidence in a manner consistent 


with professional responsibility requirements concerning the maintenance of attorney-client and 
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other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
The government, however, does not at this time anticipate that any of the items described in 
Attachment A will contain materials requiring review by a designated filter team. 
CONCLUSION 

101. Based on the forgoing, I request that the Court issue the proposed search warrant. 

102. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

103. J further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 


documents because their premature disclosure may seriously jeopardize that investigation. 
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Respectfully submitted, 


Andrew Mitchell 
Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this < / day of July, 2018. 


oO 
The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to search history information associated with the following accounts 
stored at premises owned, maintained, controlled, or operated by Google, LLC, in Mountain 


View, California: 
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ATTACHMENT B 
Particular Things to be Seized 
I. Files and Accounts to be produced by the Provider: 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, tiles, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 


to disclose the following information to the government for each account or identifier listed in 


Attachment A: 


a. All search history information associated with each account. 


II. Information to be Seized by Law Enforcement Personnel 
Any and all records that relate in any way to the accounts described in Attachment A 

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 
U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), 
and 52 U.S.C. § 30121 (foreign contribution ban) for the period from June 2015 to the present, 
including: 

a. All records, information, documents or tangible materials that relate in any way to 

communications regarding hacking, release of hacked material, communications with 

persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 


communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 
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b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Roger Stone, Julian Assange, or 
any individual associated with the Trump Campaign; 


e. Evidence indicating the account owner’s state of mind as it relates to the crimes under 


investigation; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Information, documentation and records relating to who created, used, or communicated 
with the account or identifier concerning the messages identified above, including records 
about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All evidence of wiping software, encryption or other methods to avoid detection by law 
enforcement; 


g. Evidence of passwords and encryption keys, and other access information that may be 
necessary to access the account and other associated accounts; 


h. Evidence of credit card and other financial information, including but not limited to, bills 
and payment records evidencing ownership of the subject account; 


I. Review Protocols 


Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 
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AO 93 (Rey. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


Case; 1:18-sc-02570 
Assigned To : Howell, Beryl A. 


) 
) 
INFORMATION ASSOCIATED WITH THREE ee Date : 8/2/2018 
escription: : 
ACCOUNTS STORED AT PREMISES ) ption: Search & Seizure Warrant 
CONTROLLED BY FACEBOOK ) 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 


of the following person or property located in the Northern District of California 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before August 15, 2018 (not to exceed 14 days) 
in the daytime 6:00 a.m. to 10:00 p.m. C at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 3 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

for days (not to exceed 30) O until, the facts justifying, the later specific date of 


Date and time issued: Pofa Sj of 2 i SFM) 7 LEC Mr 


udge 's signature 


City and state: Washington, DC o Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 
Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 


designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Facebook accounts, 
which are stored at premises owned, maintained, controlled, or operated by Facebook, Inc. 


(“Facebook”), a company headquartered at 1 Hacker Way, Menlo Park, California 94025: 
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ATTACHMENT B 
I. Information to be disclosed by Facebook 
To the extent that the information described in Attachment A is within the possession, 
custody, or control of Facebook Inc. (“Facebook”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Facebook, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the 
following information to the government for each user ID listed in Attachment A: 
(a) All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers. 
(b) All activity logs for the account and all other documents showing the user’s posts 
and other Facebook activities; 
(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 
(d) All profile information; News Feed information; status updates; videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including 
the friends’ Facebook user identification numbers; groups and networks of which 
the user is a member, including the groups’ Facebook group identification numbers; 
future and past event postings; rejected “Friend” requests; comments; gifts; pokes; 


tags; and information about the user’s access and use of Facebook applications; 


2. 
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(e) 


(f) 
(g) 


(h) 
(i) 


G) 
(k) 
(I) 
(m) 
(n) 
(0) 


(p) 


(q) 
(r) 


All other records of communications and messages made or received by the user, 
including all private messages, chat history, video calling history, and pending 
“Friend” requests; 

All records relating to machine cookies; 

All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

All IP logs, including all records of the IP addresses that logged into the account; 
All records of the account’s usage of the “Like” feature, including all Facebook 
posts and all non-Facebook webpages and content that the user has “liked”; 

All information about the Facebook pages that the account is or was a “fan” of; 
All past and present lists of friends created by the account; 

All records of Facebook searches performed by the account; 

All information about the user’s access and use of Facebook Marketplace; 

The types of service utilized by the user; 

The length of service (including start date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
information for the creator and/or administrator of the group and a PDF of the 
current status of the group profile page; 

All past and present Admins for the group; 


The “Creator” of the group; 


a. 
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(t) 


(u) 


All privacy settings and other account settings, including privacy settings for 
individual Facebook posts and activities, and all records showing which Facebook 
users have been blocked by the account; 

All records pertaining to communications between Facebook and any person 
regarding the user or the user’s Facebook account, including contacts with support 
services and records of actions taken; 

All records related to advertisements and advertising conducted through the 
accounts, including advertisements purchased, advertising parameters (search 


terms, groups, geographic areas) selected and queried. 


Il. Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 


U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), 


and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 2015 to the present, 


including: 


a. 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 


or other obfuscation about knowledge of, or access to, hacked material; 
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b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Roger Stone, = O 


Corsi, Julian Assange, and individual associated with WikiLeaks and/or with the 


Trump Campaign; 


re Communications, records, documents, and other files related to any expenditure, 


independent expenditure, or disbursement for an electioneering communication; 


d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 


government, foreign officials, foreign entities, foreign persons, or foreign 


principals; 


e: Communications, records, documents, and other files that reveal efforts by any 


person to conduct activities on behalf of, for the benefit of, or at the direction of 


any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 


E Evidence indicating how and when the account was accessed or used, to determine 


the geographic and chronological context of account access, use, and events relating 


to the crimes under investigation and to the account owner; 


g. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 
h. The source of all funds used to purchase advertisements or make other expenditures 


or disbursements in these accounts; 


i. The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 
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$ The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

k. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 


principals. 
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UNITED Stes De COURT FILED 
rie AUG ~ 2 2018 


District of Columbia Clerk, U.S 
K U.S. District & Bankru 
Courts for the District pf Cale 
In the Matter of the Search of iii 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH THREE ACCOUNTS 
STORED AT PREMISES CONTROLLED BY FACEBOOK 


Case: 1:18-sc-02570 

Assigned To : Howell, Beryl A. 

Assign. Date : 8/2/2018 

Description: Search & Seizure Warrant 


ON INANA N Ny 


APPLICATION FOR A SEARCH WARRANT 
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property to be searched and give its location): 


See Attachment A 
located in the Northern District of California 


person or describe the property to be seized): 


See Attachment B 


, there is now concealed (identify the 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
Sf evidence of a crime; 
Mf contraband, fruits of crime, or other items illegally possessed; 
wm property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 


18 U.S.C. §§ 2, 3, 4, 371 Aiding & Abetting, Accessory after the Fact, Misprision of a Felony, Conspiracy 
18 U.S.C. §§ 1030, 1343, 1349 Unauthorized Access of Protected Computer, Wire Fraud, Wire Fraud Conspiracy 
52 U.S.C. § 30121 Foreign Contribution Ban 


The application is based on these facts: 
See attached Affidavit. 


( Continued on the attached sheet. 
O Delayed notice of days (give exact ending date if more than 30 days: 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


) is requested 


Reviewed by AUSA/SAUSA: Applicant's signature 
Kyle R. Freeny (ASC) Andrew Mitchell, Special Agent, FBI 
r j l Printed name and title 


Sworn to before me and signed in my presence. 


Date: (LA AS E i yf C7 Vitae 


Judge's signature 


City and state: Washington, D.C. i Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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FILED 
IN THE UNITED STATES DISTRICT COURT AUG - 2 2018 


FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District & Bankruptey 


Courts 
| rts for the District of Columbla 


IN THE MATTER OF THE SEARCH OF 


INFORMATION ASSOCIATED WITH Case: 1:18-sc-02570 

THREE FACEBOOK ACCOUNTS Assigned To : Howell, Beryl A 

STORED AT PREMISES CONTROLLED Assign. Date : 8/2/2018 . 

BY FACEBOOK, INC. Description: Search & Seizure Warrant 
AFFIDAVIT IN SUPPORT OF 


AN APPLICATION FOR A SEARCH WARRANT 

I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

i I make this affidavit in support of an application for a search warrant for 


information associated with the Facebook accounts associated with the following user IDs: 


which are stored at premises owned, maintained, controlled or operated by Facebook Inc., a social 
networking company headquartered in Menlo Park, California (“Facebook”). The information to 
be disclosed by Facebook and searched by the government is described in the following paragraphs 
and in Attachments A and B. 

2, I am a Special Agent with the Federal Bureau of Investigation (FBI), and have 
been since 2011. As a Special Agent of the FBI, I have received training and experience in 
investigating criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 


experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
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intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1030 (unauthorized access of a protected computer), 18 U.S.C. § 1343 (wire fraud), and 
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. 

§ 30121(a)(1)(C) (foreign expenditure ban). There also is probable cause to search the 
information described in Attachment A for evidence, contraband, fruits, and/or instrumentalities 
of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

S; This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 
PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 

actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 


Donald J. Trump (the “Campaign’”) until August 2015. Although Stone had no official 


es 
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relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of Trump’s presidential campaign. As 
described further below, STONE also maintained contact with individuals employed by the 
Campaign, including then-campaign chairman Paul MANAFORT and deputy chairman Rick 
GATES. 
ii. Jerome CORSI 

T; Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 


contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 


As 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9, On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 


and maintained that access until at least June 2016.” The USIC attributed these cyber activities 


to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 


-4. 


Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 14 of 47 


in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 


elections in numerous Florida counties. 
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18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
(Case No. 1:18-cr-00125). 

C. STONE?’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 


22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, Stone was asked: “With regard 
to the October surprise, what would be your forecast on that given what Julian Assange has 
intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with ASSANGE. I believe the next tranche of his documents 
pertain to the Clinton Foundation but there’s no telling what the October surprise may be.” A 
few days later, STONE clarified that while he was not personally in touch with ASSANGE, he 
had a close friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 


27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted stating: “Trust me, 
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it will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview 
that same day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both 
his and [Assange], the public [could] expect to see much more from the exiled whistleblower in 
the form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think 
Julian Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. 
I believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and alot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 


32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, John Podesta — referring back to STONE’s 
August 21, 2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable 
assumption to - or at least a reasonable conclusion - that [STONE] had advanced warning [of the 
release of his emails] and the Trump campaign had advanced warning about what Assange was 
going to do. I think there’s at least a reasonable belief that [Assange] may have passed this 
information on to [STONE].” Commenting to the NBC News, STONE indicated that he had 
never met or spoken with Assange, saying that “we have a mutual friend who’s traveled to 
London several times, and everything I know is through that channel of communications. I’m not 
implying I have any influence with him or that I have advanced knowledge of the specifics of 
what he is going to do. I do believe he has all of the e-mails that Huma Abedin and Chery] Mills, 
the Clinton aides, thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta's email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE?’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 


39. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
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Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks.! The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don't go there if you don't want us to correct you.” 

37. | Onor about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you're lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with Julian Assange in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn't matter where you get information only that it is accurate 


and authentic. The New York Times printed the Pentagon Papers which were indisputably stolen 


l On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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from the government and the courts ruled it was legal to do so and refused to issue an order 
restraining the paper from publishing additional articles. If the US government moves on you I 
will bring down the entire house of cards. With the trumped-up sexual assault charges dropped I 
don't know of any crime you need to be pardoned for - best regards. R.” That same day, 
@JulianAssange responded: “Between CIA and DoJ they're doing quite a lot. On the DoJ side 
that's coming most strongly from those obsessed with taking down Trump trying to squeeze us 
into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@wikileaks, reading: “I am doing everything possible to address the issues at the highest level of 
Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 
forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with stone En Others Regarding 
Forthcoming Leaks 


41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE's address, On October 


17, 2017, Chief Judge Beryl A. Howell issued a search warrant for one of STONE'S 
addresses i On or about December 19, 2017, Chief Judge Beryl A. 
Howell issued a search warrant To EA account. On or about March 14, 2018, 
Chief Judge Beryl A. Howell issued a search warrant for STONE’s iCloud account. Information 
recovered pursuant to those search warrants indicated the following: 

42. Onor about May 15, 2016, J emailed CORSI: “Here is my flight 
schedule. Need to get something confirmed now... .” CORSI responded, “I copied Roger 


Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 


Bi 
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appears to have forwarded the message to STONE i _ who replied to 


CORSI that, “May meet Manafort -guarantee nothing.” 


43, On or about May 18, 2016, CORSI emailed STONE at as] 


with the title, “Roger -- why don't you look this over before I send mm. believe that 


CORSI wrote, 


and I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

44. On July 25, 2016, STONE, using pI sent an email to 

CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

45. On or about July 31, 2016, STONE, SA o emailed 
CORSI with the subject line, “Call me MON.” The body of the email read: p= should see 
Assange[.] | find Bernie [SJanders brother who called Bill a Rapist — turn him for 
Trump[.] | Ee find bio 2 or more proof of Bill getting kicked out.” 

46. On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 
a “Word is friend in embassy plans 2 more dumps. One shortly after I'm 
back. 2nd in Oct. Impact planned to be very damaging. Signs are Fox will have me on mid-Aug. 
more post Ailes shakeup underway. Expect Shine to surface victor, for now. Post-DNC bump for 
HRC an artifact of rigged polling. Won't last. I expect presidential campaign to get serious 


starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed as in bed w 
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enemy if they are not ready to drop HRC. That appears to be the game hackers are now about. 
Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor she well. I 
expect that much of next dump focus, setting stage for Foundation debacle.” Investigators 
believe that CORSI’s reference to a “friend in embassy [who] plans 2 more dumps” refers to 
Julian ASSANGE, the founder of WikiLeaks, who resided in Ecuador’s London Embassy in 
2016. 

47. On or about August 5, 2016, o an associate of STONE’s, emailed 


STONE at The email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” ae subsequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet AS sanoe also stated 


that in 2018, told STONE he would be interviewed by the FBI and would have to 


divulge the conversation about meeting ASSANGE. STONE GC g was joking and 
had not actually met ASSANGE. 
48. On or about August 15, 2016, CORSI emailed STONE at 


: “Give me a call today if you can. Despite MSM drumroll that HRC is 


already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 
49. On or about August 31, 2016, CORSI emailed STONE at 


: “Did you get the PODESTA writeup.” STONE replied “yes.” 


50. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 


investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 


aiae 
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S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

a1. On or about September 6, 2016, CORSI emailed STONE at 
(ones “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

52. On or about September 24, 2016, JMEEEMemailed CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.” IE wrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators, EE E this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

53. On or about October 3, 2016, an associate of STONE emailed STONE at 
0o g asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON and wrote: “You should call Roger. See below. You didn’t get from me.” BANNON 
wrote back, “I’ve got important stuff to worry about.” The associate responded, “Well clearly he 
knows what Assange has. I’d say that’s important.” 

54. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 


information “affecting three powerful organizations in three different states, as well as, of course, 


afc 
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information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

53. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

56. That same day, BANNON emailed STONE ay UU “What was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” Stone replied, “Don't think so BUT his lawyer is a big 
democrat.” 

57. | When BANNON spoke with investigators during a voluntary proffer on February 
14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was about 
WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE 
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. 


58. According to a publicly available news article,” at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 


article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 


2 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 1d74714-8ce5-11e6-875e-2c1 bfe943b66_story.html 
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from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

59. According to phone r E approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

60. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

61. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

62. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 


63. At approximately 4:00PM, the Washington Post published a story regarding the 


Access Hollywood tape. 
64. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 


hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, when CORSI emailed STONE Go hë 


wrote, “I expect that much of next dump focus, setting stage for Foundation debacle.” 


65. At approximately zami sent STONE an email titled, 


“WikiLeaks — The Podesta Emails,” with a link to the newly-released Podesta emails. 


Approximately ten minutes later, STONE, vin O for warde 


message to CORSI without comment. STONE does not appear to have forwarded the email to 


any other individual. 


-16- 


Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 26 of 47 


G. STONE Requests to CORSI for “SOMETHING” to Post About Podesta After 
STONE Is Accused of Advance Knowledge of the Leak 


66. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

67. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
sine emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it's easy to understand will take weekend. Your choice?” 

68. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at oie with a subject line 
“Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE podesta 
talking points Oct 12 2016.docx.” The “talking points” included the statement that “Podesta is at 
the heart of a Russian-government money laundering operation that benefits financially Podesta 
personally and the Clintons through the Clinton Foundation.” 

69. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 


CORSI back via the Hotmail Account, “Got them and used them.” 


AT 
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70. On or about Thursday, October 13, 2016, CORSI emailed STONE at 

Nee a “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “T ll give you one more — NOBODY YET HAS THISJ:] It looks to me 
ike OE maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once —— 4 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank{.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

71. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 

sent STONE an email ‘ie }:: the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money a a controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, launder through 


Metcombank, a Russian regional bank owned 99.978 percent i with the money 


“1 Re 
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transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

T2. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “Pin in NYC, Thinking about wriling piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

T3: On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

74. On or about October 17, 2016, CORSI emailed STONE at 
O OT 
ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

TS: On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 


“Pls call. Important.” 
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76. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

77. Onor about November 8, 2016, the United States presidential election took place. 

78. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 

79, On or about November 10, 2016, CORSI messaged STONE at his iCloud 


account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 
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L. D: -nt Regarding STONE’s Use of Facebook 


86. On or about Friday, May 18, 2016, ae... voluntarily interviewed 


by investigators from the Special Counsel’s Office. O= Q investigators that he became 


STONE’s assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE’ s 
right-hand man. 

87. According 7 STONE utilized the services of several individuals to 
post social media content to Facebook and Twitter, and that he = Q STONE both 
instructed these individuals about what to post. O R that he purchased a couple 
hundred fake Facebook accounts as part of this work (including both new and existing accounts), 
and that bloggers working for STONE would try to build what looked like real Facebook 
accounts.? According o one of the individuals who did work for STONE on 
Facebook in 2016 was Everett WILKINSON, a social media marketer and IT expert. 

88. aA further stated that STONE wanted to push out WikiLeaks content 
through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails 


was pushed out through STONE’s Facebook and Twitter accounts. 


3 Facebook requires that all users of Facebook accounts use their actual name while registering 
and operating their accounts. The terms of service explicitly require that “Facebook users 
provide their real names and information .... You will not provide any false personal 
information on Facebook, or create an account for anyone other than yourself without 
permission.” 


eo 
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J. The Target Accounts 


89. According to subscriber records obtained from Facebook, Target Account 1, 


with Facebook user ID ee is registered with the vanity name “rogerstone” and 


the email address = Target Account 1 is associated wit iii 
P| Based on search warrant returns for STONE’s BE 2 <count 


n between on or about October 31, 2016 and November 3, 2016, 
O= R receipts from Facebook for the purchase of a number of 


advertisements associated with the Target Account, including advertisements with the following 


excerpted titles (as set forth in the receipts): 
e “BREAKING: New #Wikileaks emails prove that Team...” 
e “Roger Stone talked about WikiLeaks, Donald Trump,...” 
90. Additionally, on or about March 31, 2017, STONE received a Facebook receipt at 


his Hotmail account for advertisements associated with Target Account 1, with the following 


excerpted titles (as set forth in the receipt): 
ə “Stone Rebuts Charge of Russian Collusion” 
ə “J am not in touch with any Russians, don’t have...,” 
e “The charge that I am working for Russian...,” 
e “In fullest statement yet on DNC hacking...” 


e “ROGER STONE - NO consensus that Guccifer 2.0 is a...” 


91. Target Account 2, with Facebook user im CS@Y is registered 
with the vanity name “rogerstone,” using the email account O On or 


about August 13, 2017, STONE received a receipt from Facebook for several advertisements 


«2 3= 
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associated with Target Account 2, including an advertisement with the excerpted title, “I am not 


in touch with any Russians...” 


92. Target Account 3 has the Facebook user ID o A was created 
on or about October 27, 2015. The account is registered in the name of Pom using 
the email address ee r and the verified telephone number eas 

E According to a public records database, the telephone number ——!, is linked to 

oe Search warrant returns for STONE’s flBeccount contain a notification from 
Google indicating no iii listed as the recovery email for 
S Search warrant returns for STONE’ S- -oun also 
contain a number of emails from Facebook i relating to Target 


Account 3, which may have been auto-forwarded to STONE’s Hotmail account. These emails 
include a notification of a password change to Target Account 3 and at least one receipt for a 
Facebook advertisement associated with Target Account 3, sent on or about June 30, 2016. At 
least one of these emails was then forwarded to O : <0: © X 

93. As explained further below, in my training and experience, I know that, in 
addition to posting content and purchasing advertisements, Facebook accounts can be used to 
communicate privately and directly with other users through Facebook’s messaging function. 
This function is similar to the direct messaging function of Twitter, which STONE used to 
communicate with WikiLeaks and ASSANGE in 2016 and 2017. 

BACKGROUND CONCERNING FACEBOOK 
94. Facebook owns and operates a free-access social networking website of the same 


name that can be accessed at http://www.facebook.com. Facebook allows its users to establish 


Q investigators that he would sometimes send emails from STONE’s account. 


FAs 
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accounts with Facebook, and users can then use their accounts to share written news, photographs, 
videos, and other information with other Facebook users, and sometimes with the general public. 

95. Facebook asks users to provide basic contact and personal identifying information 
to Facebook, either during the registration process or thereafter. This information may include the 
user’s full name, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook 
security questions and answers (for password retrieval), physical address (including city, state, and 
zip code), telephone numbers, screen names, websites, and other personal identifiers. Facebook 
also assigns a user identification number to each account. 

96. Facebook users may join one or more groups or networks to connect and interact 
with other users who are members of the same group or network. Facebook assigns a group 
identification number to each group. A Facebook user can also connect directly with individual 
Facebook users by sending each user a “Friend Request.” If the recipient of a “Friend Request” 
accepts the request, then the two users will become “Friends” for purposes of Facebook and can 
exchange communications or view information about each other. Each Facebook user’s account 
includes a list of that user’s “Friends” and a “News Feed,” which highlights information about the 
user’s “Friends,” such as profile changes, upcoming events, and birthdays. 

97. Facebook users can select different levels of privacy for the communications and 
information associated with their Facebook accounts. By adjusting these privacy settings, a 
Facebook user can make information available only to himself or herself, to particular Facebook 
users, or to anyone with access to the Internet, including people who are not Facebook users. A 
Facebook user can also create “lists” of Facebook friends to facilitate the application of these 
privacy settings. Facebook accounts also include other account settings that users can adjust to 


control, for example, the types of notifications they receive from Facebook. 


258 


Case 1:19-mc-00029-CRC Document 29-12 Filed 04/28/20 Page 35 of 47 


98. Facebook users can create profiles that include photographs, lists of personal 
interests, and other information. Facebook users can also post “status” updates about their 
whereabouts and actions, as well as links to videos, photographs, articles, and other items available 
elsewhere on the Internet. Facebook users can also post information about upcoming “events,” 
such as social occasions, by listing the event’s time, location, host, and guest list. In addition, 
Facebook users can “check in” to particular locations or add their geographic locations to their 
Facebook posts, thereby revealing their geographic locations at particular dates and times. A 
particular user’s profile page also includes a “Wall,” which is a space where the user and his or 
her “Friends” can post messages, attachments, and links that will typically be visible to anyone 
who can view the user’s profile. 

99. Facebook allows users to upload photos and videos, which may include any 
metadata such as location that the user transmitted when s/he uploaded the photo or video. It also 
provides users the ability to “tag” (i.e., label) other Facebook users in a photo or video. When a 
user is tagged in a photo or video, he or she receives a notification of the tag and a link to see the 
photo or video. For Facebook’s purposes, the photos and videos associated with a user’s account 
will include all photos and videos uploaded by that user that have not been deleted, as well as all 
photos and videos uploaded by any user that have that user tagged in them. 

100. Facebook users can exchange private messages on Facebook with other users. 
These messages, which are similar to e-mail messages, are sent to the recipient’s “Inbox” on 
Facebook, which also stores copies of messages sent by the recipient, as well as other information. 
Facebook users can also post comments on the Facebook profiles of other users or on their own 
profiles; such comments are typically associated with a specific posting or item on the profile. In 


addition, Facebook has a Chat feature that allows users to send and receive instant messages 
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through Facebook. These chat communications are stored in the chat history for the account. 
Facebook also has a Video Calling feature, and although Facebook does not record the calls 
themselves, it does keep records of the date of each call. 

101. Ifa Facebook user does not want to interact with another user on Facebook, the 
first user can “block” the second user from seeing his or her account. 

102. Facebook has a “like” feature that allows users to give positive feedback or connect 
to particular pages. Facebook users can “like” Facebook posts or updates, as well as webpages or 
content on third-party (i.e., non-Facebook) websites. Facebook users can also become “fans” of 
particular Facebook pages. 

103. Facebook has a search function that enables its users to search Facebook for 
keywords, usernames, or pages, among other things. 

104. Each Facebook account has an activity log, which is a list of the user’s posts and 
other Facebook activities from the inception of the account to the present. The activity log includes 
stories and photos that the user has been tagged in, as well as connections made through the 
account, such as “liking” a Facebook page or adding someone as a friend. The activity log is 
visible to the user but cannot be viewed by people who visit the user’s Facebook page. 

105. Facebook Notes is a blogging feature available to Facebook users, and it enables 
users to write and post notes or personal web logs (“blogs”), or to import their blogs from other 
services, such as Xanga, LiveJournal, and Blogger. 

106. The Facebook Gifts feature allows users to send virtual “gifts” to their friends that 
appear as icons on the recipient’s profile page. Gifts cost money to purchase, and a personalized 


message can be attached to each gift. Facebook users can also send each other “pokes,” which are 
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free and simply result in a notification to the recipient that he or she has been “poked” by the 
sender. 

107. Facebook also has a Marketplace feature, which allows users to post free classified 
ads. Users can post items for sale, housing, jobs, and other items on the Marketplace. 

108. In addition to the applications described above, Facebook also provides its users 
with access to thousands of other applications (“apps”) on the Facebook platform. When a 
Facebook user accesses or uses one of these applications, an update about that the user’s access or 
use of that application may appear on the user’s profile page. 

109. Some Facebook pages are affiliated with groups of users, rather than one individual 
user. Membership in the group is monitored and regulated by the administrator or head of the 
group, who can invite new members and reject or accept requests by users to enter. Facebook can 
identify all users who are currently registered to a particular group and can identify the 
administrator and/or creator of the group. Facebook uses the term “Group Contact Info” to 
describe the contact information for the group’s creator and/or administrator, as well as a PDF of 
the current status of the group profile page. 

110. Facebook uses the term “Neoprint” to describe an expanded view of a given user 
profile. The “Neoprint” for a given user can include the following information from the user’s 
profile: profile contact information; News Feed information; status updates; links to videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends’ 
Facebook user identification numbers; groups and networks of which the user is a member, 
including the groups’ Facebook group identification numbers; future and past event postings; 
rejected “Friend” requests; comments; gifts; pokes; tags; and information about the user’s access 


and use of Facebook applications. 
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111. Facebook also retains Internet Protocol (“IP”) logs for a given user ID or IP address. 
These logs may contain information about the actions taken by the user ID or IP address on 
Facebook, including information about the type of action, the date and time of the action, and the 
user ID and IP address associated with the action. For example, if a user views a Facebook profile, 
that user’s IP log would reflect the fact that the user viewed the profile, and would show when and 
from what IP address the user did so. 

112. Social networking providers like Facebook typically retain additional information 
about their users’ accounts, such as information about the length of service (including start date), 
the types of service utilized, and the means and source of any payments associated with the service 
(including any credit card or bank account number). In some cases, Facebook users may 
communicate directly with Facebook about issues relating to their accounts, such as technical 
problems, billing inquiries, or complaints from other users. Social networking providers like 
Facebook typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. 

113. As explained herein, information stored in connection with a Facebook account 
may provide crucial evidence of the “who, what, why, when, where, and how” of the criminal 
conduct under investigation, thus enabling the United States to establish and prove each element 
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Facebook user’s “Neoprint,” IP log, stored electronic communications, and other data retained by 
Facebook, can indicate who has used or controlled the Facebook account. This “user attribution” 
evidence is analogous to the search for “indicia of occupancy” while executing a search warrant 


at a residence. For example, profile contact information, private messaging logs, status updates, 
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and tagged photos (and the data associated with the foregoing, such as date and time) may be 
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook 
account activity can show how and when the account was accessed or used. For example, as 
described herein, Facebook logs the Internet Protocol (IP) addresses from which users access their 
accounts along with the time and date. By determining the physical location associated with the 
logged IP addresses, investigators can understand the chronological and geographic context of the 
account access and use relating to the crime under investigation. Such information allows 
investigators to understand the geographic and chronological context of Facebook access, use, and 
events relating to the crime under investigation. Additionally, Facebook builds geo-location into 
some of its services. Geo-location allows, for example, users to “tag” their location in posts and 
Facebook “friends” to locate each other. This geographic and timeline information may tend to 
either inculpate or exculpate the Facebook account owner. Last, Facebook account activity may 
provide relevant insight into the Facebook account owner’s state of mind as it relates to the offense 
under investigation. For example, information on the Facebook account may indicate the owner’s 
motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or 
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from 
law enforcement). 

114. Therefore, the computers of Facebook are likely to contain all the material 
described above, including stored electronic communications and information concerning 
subscribers and their use of Facebook, such as account access information, transaction information, 
and other account information. 


FILTER REVIEW PROCEDURES 
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115. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “‘filter 
tean,” separale and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

116. Based on the forgoing, I request that the Court issue the proposed search warrant. 

117. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

118. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 


documents because their premature disclosure may seriously jeopardize that investigation. 


i. 
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Respectfully submitted, 


Andrew Mitchel 


Special Agent 
Federal Bureau of Investigation 


9 yf 
Subscrihed and sworn to before me on this F4 day of August, 2018. 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Facebook accounts, 
which are stored at premises owned, maintained, controlled, or operated by Facebook, Inc. 


(“Facebook”), a company headquartered at 1 Hacker Way, Menlo Park, California 94025: 
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ATTACHMENT B 
I. Information to be disclosed by Facebook 
To the extent that the information described in Attachment A is within the possession, 
custody, or control of Facebook Inc. (“Facebook”), including any messages, records, files, logs, or 
information that have been deleted but are still available lo Facebook, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the 
following information to the government for each user ID listed in Attachment A: 
(a) All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers. 
(b) All activity logs for the account and all other documents showing the user’s posts 
and other Facebook activities; 
(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 
(d) All profile information; News Feed information; status updates; videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including 
the friends’ Facebook user identification numbers; groups and networks of which 
the user is a member, including the groups’ Facebook group identification numbers; 
future and past event postings; rejected “Friend” requests; comments; gifts; pokes; 


tags; and information about the user’s access and use of Facebook applications; 


he 
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(e) 


(f) 
(g) 


(h) 
(i) 


G) 
(k) 
(I) 
(m) 
(n) 
(0) 


(p) 


(q) 
(r) 


All other records of communications and messages made or received by the user, 
including all private messages, chat history, video calling history, and pending 
“Friend” requests; 

All records relating to machine cookies; 

All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

All IP logs, including all records of the IP addresses that logged into the account; 
All records of the account’s usage of the “Like” feature, including all Facebook 
posts and all non-Facebook webpages and content that the user has “liked”; 

All information about the Facebook pages that the account is or was a “fan” of; 
All past and present lists of friends created by the account; 

All records of Facebook searches performed by the account; 

All information about the user’s access and use of Facebook Marketplace; 

The types of service utilized by the user; 

The length of service (including start date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
information for the creator and/or administrator of the group and a PDF of the 
current status of the group profile page; 

All past and present Admins for the group; 


The “Creator” of the group; 
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(s) 


(t) 


(u) 


All privacy settings and other account settings, including privacy settings for 
individual Facebook posts and activities, and all records showing which Facebook 
users have been blocked by the account; 

All records pertaining to communications between Facebook and any person 
regarding the user or the user’s Facebook account, including contacts with support 
services and records of actions taken; 

All records related to advertisements and advertising conducted through the 
accounts, including advertisements purchased, advertising parameters (search 


terms, groups, geographic areas) selected and queried. 


Il. Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 


U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), 


and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 2015 to the present, 


including: 


a. 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 


or other obfuscation about knowledge of, or access to, hacked material; 


H 
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b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Roger Stone, = K 
Corsi, Julian Assange, and individual associated with WikiLeaks and/or with the 
Trump Campaign; 

Ü; Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

é. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

ji Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 


to the crimes under investigation and to the account owner; 


g. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 
h. The source of all funds used to purchase advertisements or make other expenditures 


or disbursements in these accounts; 
i, The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 
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j The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

k. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)}—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 


principals. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 


District of Columbia 


In the Matter of the Search of 


) 
(Briefly describe the property to be searched ) Case: 1:18-sc-02581 
or identify the person by name and address) ) Assig ned To: Howell, Beryl A. 
) 
) 


INFORMATION ASSOCIATED WITH THREE Assign. Date : 8/3/2018 _ 
ACCOUNTS STORED AT PREMISES CONTROLLED Description: Search & Seizure Warrant 
BY MICROSOFT, GOOGLE, AND APPLE 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California 


(identify the person or describe the property to be searched and give its location): 


See Attachment E 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment F 


YOU ARE COMMANDED to execute this warrant on or before August 15, 2018 (not to exceed 14 days) 
@ in the daytime 6:00 a.m. to 10:00 p.m. O at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) until, the facts justifying, the later specific date of 


Date and time issued: SV? Fi Li Y sJ Z Arg AA LIELA Z MAAA 


Judge's signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 
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ATTACHMENT E 
Property to be Searched 


This warrant applies to information associated with the following Apple DSID: 


created or maintained between March 14, 2018 and the present, that is stored at premises owned, 
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino, 


California 95014. 
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ATACHMENT F 
Particular Things to be Seized 


I. Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment E is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, files, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment E: 


a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email! addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 


b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (““UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMSI”), and International Mobile 
Station Equipment Identities (“IMEI”); 


c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 


d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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& The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 


f All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 


g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 


h. All records pertaining to the types of service used; 


i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 


j. All files, keys, or other information necessary to decrypt any data produced in an 


encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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II. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome ss Julian Assange, 

ear Randy Credico, or any individual 
associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 


56 


Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 7 of 189 


AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT a fe Re 
for the AUG =y 2018 


Ditet or Cutowbhin Clerk, U.S. District & Bankruptey 
Courts for the District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 

or identify the person by name and address) 
INFORMATION ASSOCIATED WITH THREE ACCOUNTS 
STORED AT PREMISES CONTROLLED BY MICROSOFT, 


GOOGLE, AND APPLE 


Case: 1:18-sc-02581 

Assigned To : Howell, Beryl A. 

Assign. Date : 8/3/2018 

Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property to be searched and give its location): 


See Attachment E 

located in the Northern District of California , there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment F 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; ; 
contraband, fruits of crime, or other items illegally possessed; 
Af property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 


18 U.S.C. §§ 1505, 1512, 1513 Obstruction of justice, Witness tampering 
18 U.S.C. §§ 1001, 1030,371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 


See Affidavit for add'l 


The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 
Reviewed by AUSA/SAUSA: Applicant’s signature za 


Aaron Zelinsky (ASC) Andrew Mitchell, Special Agent, FBI 
Printed name and title 


Sworn to before me and signed in my presence. 


Date: £1 èf tF LEZ. MEL 
udge's signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 


City and state: Washington, D.C. 
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FILED 
AUG ~ 3 2018 
Clerk, U.S. District & Bankrupt 
Courts for the District of Colonha 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 


INFORMATION ASSOCIATED WITH Case: 1:18-sc-02581 

THREE ACCOUNTS STORED AT Assigned To : Howell, Beryl A. 
PREMISES CONTROLLED BY Assign. Date : 8/3/2018 

MICROSOFT, GOOGLE, AND APPLE Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

if I make this affidavit in support of an application for a search warrant for 
information associated with the following: 

a. The email account = QB “Target Account 1), that is 
stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with 
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be 
disclosed by Microsoft and searched by the government is described in the following paragraphs 


and in Attachments A and B. 


b. The email account Oo Q “Target Account 2”), that is 


stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with 
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The 
information to be disclosed by Google and searched by the government is described in the 


following paragraphs and in Attachments C and D. 


c. The iCloud account D associated with the Apple ẹmail account 
-o “Target Account 3”), that is stored at premises owned, 
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maintained, controlled, or operated by Apple, Inc., a business with offices located at 1 Infinite 
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by 
the government is described in the following paragraphs and in Attachment E and F. 

Z. I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation 
(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and 
experience in investigating criminal and national security matters. 

3, The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain communications relevant to 
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 
(misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 
U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512 
(obstruction of justice), 18 U.S.C. § 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign 
contribution ban) (the “Subject Offenses”). 

3; On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for Roger STONE’ s Hotmail address RR 


Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE’s 


Gmail address i (Target Account 2). On or about March 14, 2018, Chief 


Judge Howell issued a search warrant for STONE’s iCloud account (Target Account 3). This 


2 
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warrant seeks to search those accounts from the date each respective warrant was issued to the 
present. 
JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 2711(3)(A)G). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraphs 14, 19, and 61. 

SUMMARY 

T This application seeks authority to search, from the date of search warrants 
previously issued by the Court to the present, three accounts believed to be used by Roger 
STONE: Target Account 1, which is STONE’s cco Target Account 2, which is 
STONE? sf ccount; and Target Account 3, which is STONE’s iCloud account. As set 
forth herein, there is probable cause to believe that each of the Subject Accounts contains 
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with 
witnesses, and make false statements. 

8. For example, as set forth in more detail below, in recent months STONE has 
reached out to communicate with multiple witnesses he knew or had reason to believe were 
scheduled to testify before Congress about interactions with STONE during the 2016 presidential 


campaign or were scheduled to meet with the Special Counsel’s Office TT’ 


SA fier STONE learned that one witness, Randy 


CREDICO, was prepared to contradict STONE’s congressional testimony, STONE repeatedly 
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urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so 


through multiple text messages. In June 2018, STONE instructed his private investigator to 


provide him with a full background investigation on another witeess o o who had 


done information technology work for STONE during the campaign 


9. In September 2017, STONE released a statement he said he provided to Congress 


in which he denied having advance knowledge of “the source or actual content of the Wikileaks 
disclosures regarding Hillary Clinton.” He also stated publicly that when he tweeted during the 
campaign, on August 21, 2016, “it will soon the Podesta’s time in the barrel,” he was not 
referring to the hacking or publication of John Podesta’s emails, but rather to “Podesta’s business 
dealings with Russia.” Evidence obtained in the investigation, however, shows the following: 

a. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to “Get 
to Assange” at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” Julian 
ASSANGE is the founder of WikiLeaks. On or about July 31, 2016, STONE also instructed 
CORSI to have R8 ASSANGE. On or about August 2, 2016, CORSI 
responded to STONE that the “[w]ord is friend in embassy plans 2 more dumps. One shortly 
after I’m back. 2nd in Oct. Impact planned to be very damaging.... Time to let more than 
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC.” After receipt of 
that message, on or about August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, 
it will soon the Podesta’s time in the barrel. #CrookedHillary.” 

b. Information disclosures subsequently occurred on or about the times 
CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the 


United States (“shortly after I’m back”), Guccifer 2.0 released hacked information related to the 


4 


Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 12 of 189 


Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day 
the Washington Post published a breaking story about an Access Hollywood videotape of then- 
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked 
from the account of John Podesta. 

ro Furthermore, on the day of the Access Hollywood video disclosure, there 
were phone calls between STONE and CORSI after the Washington Post contacted STONE 
prior to publication. At approximately 11:00AM, the Washington Post received a tip regarding 
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE 
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM, 
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called 
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post 


published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks 


tweeted out its first release of emails hacked from John Podesta. 
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PROBABLE CAUSE. 


A. Background on Relevant Individuals 
i. Roger STONE 
10. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii. Jerome CORSI 
11. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. U.S. Intelligence Community Assessment of Russian Government-Backed Hacking 
Activity during the 2016 Presidential Election 


13. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 
the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following: 

a. The U.S. Intelligence Community (“USIC”) is confident that the Russian 
Government directed the recent compromises of emails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked emails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 


with the methods and motivations of Russian-directed efforts. These thefts and disclosures were 
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intended to interfere with the U.S. election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

14. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

a. “Russian President Vladimir Putin ordered an influence campaign in 2016 
aimed at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

oa The USIC also described, at a high level, some of the techniques that the 
Russian government employed during its interference. The USIC summarized the efforts as a 
“Russian messaging strategy that blends covert intelligence operations—such as cyber activity— 
with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

C. With respect to “cyber activity,” the USIC assessed that “Russia’s 
intelligence services conducted cyber operations against targets associated with the 2016 US 
presidential election, including targets associated with both major US political parties.” Further, 
“[]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC) 


networks and maintained that access until at least June 2016.” The USIC attributed these cyber 
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activities to the Russian GRU, also known as the Main Intelligence Directorate: “GRU 
operations resulted in the compromise of the personal e-mail accounts of Democratic Party 
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the 
DNC.” The GRU is the foreign military intelligence agency of the Russian Ministry of Defense, 
and is Russia’s largest foreign intelligence agency. 

d. With respect to the release of stolen materials, the USIC assessed “with 
high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

e. Guccifer 2.0, who claimed to be an independent Romanian hacker, made 
multiple contradictory statements and false claims about his identity throughout the election. 

C. Additional Hacking Activity by Individuals Associated with the GRU 

15. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 campaign through at least 
November 1, 2016. 

16. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

17. On or about September 4, 2016, individuals associated with the GRU stole the 


emails from a former White House advisor who was then advising the Clinton Campaign. These 


emails were later posted on DCLeaks. 
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18. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

19. On or about July 13, 2018, a grand jury in this District indicted eleven GRU 
officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons 
and entities involved in the 2016 U.S. presidential election, steal documents from those 
computers, and stage releases of stolen documents in order to interfere with the election. The 
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign 
Committee (“DCCC”), and the chairman of the Clinton campaign (John Podesta). See United 
States v. Viktor Borisovich Netyksho, et al. (1:18-cr-215) (D.D.C.).! 

D. Roger STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

20. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors. The media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

Zl. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 


the DNC. 


1 A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for 
administering elections, including state boards of election, secretaries of state, and companies that supply software 
and other technology used to administer elections. 
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22. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world 
would see for themselves how the Democrats had rigged the game.” 

23. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by ASSANGE to Russia 
Today (RT) several days earlier about an upcoming “October Surprise” aimed at the Hillary 
Clinton presidential campaign. Specifically, STONE was asked: “With regard to the October 
surprise, what would be your forecast on that given what Julian Assange has intimated he’s 
going to do?” STONE responded: “Well, it could be any number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, STONE 
clarified that while he was not personally in touch with ASSANGE, he had a close friend who 
served as an intermediary. 

24. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

25. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 


2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
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Twitter account was reinstated. 

26. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

27. On August 18, 2016, Paul Manafort, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. 

28. As noted above, on August 21, 2016, using @RogerJStoneJR, STONE tweeted: 
“Trust me, it will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN 
interview that same day, STONE reiterated that because of the work of a “‘mutual acquaintance’ 
of both his and [ASSANGE], the public [could] expect to see much more from the exiled 
whistleblower in the form of strategically-dumped Clinton email batches.” He added: “Well, 
first of all, I think Julian Assange is a hero... I think he’s taking on the deep state, both 
Republican and Democrat. I believe that he is in possession of all of those emails that Huma 
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are 
like the Watergate tapes.” 

29. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

30. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

31. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 


tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
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of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

32. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

33. | Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

34. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 


35. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
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from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

E. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

36. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 

Twitter account @RogerJStoneJr. Information recovered from the search of that account 
includes the following: 

a. On October 13, 2016, while WikiLeaks was in the midst of releasing the 
hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

b. Less than an hour later, @wikileaks responded by direct message: “We 
appreciate that. However, the false claims of association are being used by the democrats to 
undermine the impact of our publications. Don’t go there if you don’t want us to correct you.” 

C. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’ re lying. Your 


operation leaks like a sieve. You need to figure out who your friends are.” 
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d. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

6; In addition, @RogerJStoneJr also exchanged direct messages with 
ASSANGE. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

f. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 


this forum as experience demonstrates it is monitored. Best regards R.” 
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F. STONE’s Communications with ston. and Others Regarding 
Forthcoming Leaks 


3T: As indicated above, on September 11, 2017, Chief Judge Howell issued a search 


warrant for STONE fit address (Target Account 1); on 


October 17, 2017, Chief Judge Howell issued a search warrant for STONE Sy address, 


Sn (Target Account 2); and on or about March 14, 2018, Chief Judge 


Howell issued a search warrant for STONE’s iCloud account (Target Account 3). In addition, 
on or about December 19, 2017, Chief Judge Howell issued a search warrant for (i 
email account. Information recovered pursuant to those search warrants includes the following: 
a. On or about May 15, 2016, | emailed CORSI: “Here is my 
flight schedule. Need to get something confirmed now... .” CORSI responded, “I copied 
Roger Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI 


that, “May meet Manafort -guarantee nothing.” 


b. On or about May 18, 2016, CORSI emailed STONE at Target Account 1 


with the title, “Roger -- why don’t you look this over before I send To believe that 


CORSI wrote, 


and I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

(a On July 25, 2016, STONE, using Target Account 1, sent an email to 


CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
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[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

d. On or about July 31, 2016, STONE, using Target Account 1, emailed 
CORSI with the subject line, “Call me MON.” The body of the email read should see 
Assange.] P| should find Bernie [S]anders brother who called Bill a Rapist — turn him for 
Trump[.] E should n or more proof of Bill getting kicked out.” 

é. As noted above, on or about August 2, 2016 (approximately 19 days 
before STONE publicly tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE 
at Target Account 1: “Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued: “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect 
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more 
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears 
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory 
bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage 
for Foundation debacle.” Investigators believe that CORSI’s reference to a “friend in embassy 


[who] plans 2 more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 


f On or about August 5, 0 o o an associate of STONE’s, 


emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton 


2016. 


led Trump by 15 points. STONE responded, “enjoy it while u can[.] I dined with my new pal 


Julian Assange last night.” is subsequently stated to investigators that, around the 
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same time, STONE told him he had gone to London to meet assancr B also stated 
that in 0 told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE TY he was joking and 
had not actually met ASSANGE.? 

g. On or about August 15, 2016, CORSI emailed STONE at Target Account 
1: “Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it’s not 
over yet. More to come than anyone realizes. Won’t really get started until after Labor Day. Pm 
in NYC this week. Jerry.” 

h. On or about August 31, 2016, CORSI emailed STONE at Target Account 
1: “Did you get the PODESTA writeup.” STONE replied “Lyles.” 

i. On or about August 31, 2016, CORSI messaged STONE at Target 
Account 3, “Podesta paid $180k to invest in Uranium One — was hired by Rosatom in Giustra 
scandal. Podesta now under FBI investigation — tied to Ukraine Yanukovych — Panama papers 
reveals Podesta hired by S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to 
Russia undermine Clinton false narrative attempting to tie Trump to Putin.” 

J: On or about September 6, 2016, CORSI emailed STONE at Target 
Account 1: “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

k. On or about September 24, 2016 emailed CORSI, “I will 


have much more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, 
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“We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to 
him about it again ody | wrote back, “Awaiting secret file. Explosive... Hope you 
are well. Can’t wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me 
posted about file[.]” In a subsequent meeting with investigators, fl indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

I. On or about October 3, 2016, an associate of STONE emailed STONE at 
Target Account 2 and asked: “Assange — what’s he got? Hope it’s good.” STONE wrote back, 
“Tt is. P’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will be 
out in Jan. Many scores will be settled.” The associate forwarded the email to Steve BANNON, 
who was CEO of the Campaign at the time, and wrote: “You should call Roger. See below. You 
didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry about.” The 
associate responded, “Well clearly he knows what Assange has. I’d say that’s important.” 

m. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

n. On or about October 4, 2016, CORSI messaged STONE at Target 


Account 3, “Assange made a fool of himself. Has nothing or he would have released it. Total 


BS hype.” 
19 


Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 27 of 189 


O. That same day, BANNON emailed STONE at Target Account 2, “What 
was that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are 
going to kill him and the London police are standing done [sic].” BANNON wrote back, “He 
didn’t cut deal w/ clintons???” STONE replied, “Don’t think so BUT his lawyer [J is a 
big democrat.” 

p. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released 


38. According to a publicly available news article,> at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood’ and NBC for reaction.” 


39. According to phone recor: ls at approximately 


11:27 AM, CORSI placed a call to STONE which STONE did not answer. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was- 
on/2016/10/07/3 1d74714-8ce5-1 1e6-875e-2c1bfe943b66_story.html 
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40. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

41. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

42. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

43. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

44. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, “I expect that much 
of next dump focus, setting stage for Foundation debacle.” 

45. At approximately on o an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target 
Account 2, forwarded T message to CORSI without comment. STONE does not appear 


to have forwarded the email to any other individual. 


H. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


46. On or about October 8, 2016, STONE, using Target Account 3, messaged 
CORSI, “Lunch postponed — have to go see T.” CORSI responded to STONE, “Ok. I 


understand.” Approximately twenty minutes later, CORSI texted, “Clintons know they will lose 
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a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs 
speech comments, attacking bad job numbers.” 

47. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
using Target Account 2, emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM, “need your BEST podesta pieces.” CORSI 
wrote back at approximately 8:54AM, “Ok. Monday. The remaining stuff on Podesta is 
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian 
translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

48. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM, 
CORSI emailed STONE at both Target Account 1 and 2 with the subject line “Podesta talking 
points.” Attached to the email was a file labeled, “ROGER STONE podesta talking points Oct 
12 2016.docx.” The “talking points” included the statement that “Podesta is at the heart of a 
Russian-government money laundering operation that benefits financially Podesta personally and 
the Clintons through the Clinton Foundation.” 

49. | CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via Target Account 1: “Got them and used them.” 

50. On or about Thursday, October 13, 2016, CORSI emailed STONE at Target 
Account 2: “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to CLINTON 
FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could post under my 
by-line since I am the one under attack by Podesta and now Mook.” CORSI wrote back to 


STONE, “I?ll give you one more — NOBODY YET HAS THIS[:] It looks to me like 
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=) skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

51. On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent 
STONE an email at Target Account 2, with the subject, “ROGER STONE article RUSSIAN 
MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN 
PODESTA.” The text stated: “Roger[,] You are free to publish this under your own name.” 
That same day, STONE posted a blog post with the title, “Russian Mafia money laundering, the 
Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I have had some 
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr. 
Podesta nor I have I ever received documents or data from Wikileaks.” The post then asked, 
“Just how much money did a a controversial Russian billionaire investor with 
ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian 
regional bank owned 99.978 percent by | | with the money transferred via Deutsche 
Bank and Trust Company Americas in New York City, with the money ending up in a private 
bank account in the Bank of America that is operated by the Clinton Foundation?” 

52. On or about October 14, 2016, CORSI sent a message to STONE at Target 
Account 3, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 


basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 
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53% On or about October 17, 2016, CORSI messaged STONE at Target Account 3, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

54. On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1 
and 2 with the subject, “Fwd: ASSANGE...URGENT...” CORSI wrote, “From a very trusted 
source,” and forwarded an email with the header information stripped out, showing only the 
body text. The email read, “Yes[.] I figured this. Assange is threatening Kerry, Ecuador and 
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set 
of dead man files that include Hillary. It’s what they used to call a ‘Mexican stand off].]’ Only 
hope is that if Trump speaks out to save him[.] Otherwise he’s dead anyway, once he’s dropped 
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to 
play out. He’s called Podesta’s bluff and raised him the election.” 

55. On or about October 18, 2016, CORSI messaged STONE at Target Account 3, 
“Pls call. Important.” 

56. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear it 
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 


ST. On or about November 8, 2016, the United States presidential election took place. 
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58. On or about November 9, 2016, CORSI messaged STONE at Target Account 3, 
“Congratulations, Roger. He could not have done it without you.” 
59. On or about November 10, 2016, CORSI messaged STONE at Target Account 3, 


“Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in London. 


Have some interesting news for you.” 
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J. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


61. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts... . 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. .. . 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
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I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 


62. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 

encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange, 

you were only referring to a single fact that you had confirmed with the intermediary — 

MR. STONE: That — 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. 

63. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 


expectation that it would become a news story.” 


K. STONE’s Use of Target Account 3 to Message Randy CREDICO about STONE’s 
“Back channel” 
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64. On November 19, 2017, Randy CREDICO (who, as described further below, 
STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE on Target 
Account 3, “My lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the 
fifth. Anything to save the plan’........ Richard Nixon[.]” CREDICO responded, “Ha ha.” 

65. On or about November 21, 2017, CREDICO messaged STONE on ears 
Account 3, “I was told that the house committee lawyer told my lawyer that | will be getting a 
subpoena[.]” STONE wrote back, “That was the point at which your lawyers should have told 
them you would assert your 5th Amendment rights if compelled to appear.” They continued to 
message, and CREDICO wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To 
do what ? Nothing happening in DC the day before Thanksgiving — why are u busting my 
chops?” 

66. On or about November 24, 2017, STONE, using Target Account 3, texted 
CREDICO, “Assange is a journalist and a damn good one- meeting with him is perfectly legal 
and all you ever told me was he had the goods [o]n Hillary and would publish them — which he 
himself said in public b4 u told me . It’s a fucking witchunt [sic].” CREDICO replied, “I told 
you to watch his tweets. That’s what I was basing it on. I told you to watch his Tweets in 
October not before that I knew nothing about the DNC stuff].] I just followed his tweets[.]” 
STONE responded, “U never said anything about the DNC but it was August.” CREDICO 
wrote back, “It was not August because I didn’t interview him or meet him until August 26th[.] 
That was my first communication with his secretary in London, August 26th.” STONE wrote 


back, “Not the way I remember it — oh well I guess Schiff will try to get one of us indicted for 


perjury[.]” 
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67. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on November 24, 2017, CREDICO wrote to STONE, “Forensic evidence proves that there is 
no back Channel. So now you can relax.” 

68. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

69. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that, “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 
content of the material.” 

70. On or about December 1, 2017, CREDICO messaged STONE on Target 
Account 3, stating, “I don’t know why you had to lie and say you had a back Channel now I had 
to give all of my forensic evidence to the FBI today what a headache[.]* You could have just told 
him the truth that you didn’t have a back Channel they now know that I was not in London until 
September of this year[.] You had no back-channel and you could have just told the truth... 
You want me to cover you for perjury now[.]” STONE responded, “What the fuck is your 
problem? Neither of us has done anything wrong or illegal. You got the best press of your life 


and you can get away with asserting for 5th Amendment rights if u don’t want talk about AND if 


4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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you turned over anything to the FBI you’re a fool.” CREDICO responded, “You open yourself 
up to six counts of perjury[.] But I’m sure that wasn’t sworn testimony so you’re probably 
clear[.] Council for the committee knows you never had a back Channel and if you had just told 
the truth wouldn’t have put me in this bad spot . . . you should go back . . . and amend your 
testimony and tell them the truth.” CREDICO repeated: “you need to amend your testimony 
before I testify on the 15th.” STONE replied, “If you testify you’re a fool. Because of tromp 
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I 
guarantee you you [sic] are the one who gets indicted for perjury if you’re stupid enough to 
testify[.]” 

71. | STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

72. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

73. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with 
a reporter. STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” 
CREDICO messaged STONE, “I have the email from his chief of staff August 25th 2016 
responding to an email J sent to WikiLeaks website email address asking you would do my 


show[.] That was my initial contact.” 
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74. On or about January 8, 2018, CREDICO messaged STONE on Target Account 3 
stating: “Embassy logs . . . + 17 other pieces of information prove that I did not have any 
conversations with Assange until September of last year.” 

das | CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE on Target Account 3: “You lied to the house Intel 
committee ... But you’ ll get off because you’re friends with Trump so don’t worry. I have all 
the forensic evidence[.] I was not a ba{ck] Channel and I have all those emails from September 
of 2016 to prove it[.]” 

76. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you start bringing up my dog, you’re crossing the line[.]”° 

77. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.° In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 


me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 


$ https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog- 
135911370.html 


6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 


L. STONE’s Use of the Target Accounts to Communicate with Individuals Related to 
the Investigation 


78. On May 17, 2018, Chief Judge Howell issued an order for the use of pen-trap 
devices on Target Account 1 and Target Account 2. The information obtained from that order, 
along with information obtained from toll records, revealed that STONE has continued to use 
Target Account 1 and Target Account 2, and that he has used them to communicate with 


individuals related to the investigation. 


79. For example, STONE on communicated twice on May 28 and May 


29, 2018 using Target Account ia. a former associate of STONE’s, was 


interviewed by the Special Counsel’s Office on or about May 2, 2018. Toll records show that 
aon and STONE communicated multiple times on May 5, 2018, and STONE 
communicated wit using Target Account 1 on June 1, 2018 and June 6, 2013 
a, a private investigator who had previously worked with STONE and who was hired 
by STONE to research individuals associated with this case (as described further below), 
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and 
July 12, 2018. 
80. STONE has also used Target Account 2 to communicate with individuals 
associated with this investigation. 
a. For example, between May 23, 2018 and the present, STONE and CORSI 
exchanged at least five messages using Target Account 2. In the same time period, STONE 


exchanged at least 75 emails with CREDICO using Target Account 2. 
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b. Also in this same time period, STONE TE o at least 
ten times using Target Account 2. | is a former employee of STONE. On May 9, 
2018, FBI agents approche c To That day, 
and again on May 10, 0 communicated by phone with 


STONE. Overall, between May 23, 2018 and the present, STONE exchanged over 100 emails 


vii using Target Account 2. In addition, between on or about June 14, 2018 and 


June 17, 2018 | and STONE exchanged five emails using Target Account 2. 


81. STONE has also used a phone number associated with Target Account 3 to 


communicate vi i a private investigator hired by stone g 


interviewed by investigators on June 7, 2018, and subsequently informed investigators that in 


June 2018, STONE instructed him to conduct a full background investigation im 


a: had been employed by STONE during the Campaign as an information technology 


specialist, 


also told investigators that in June 2018, STONE instructed him to find 
an address for CREDICO that could be used to serve CREDICO with legal process. 
ae: investigators that his primary form of communication with STONE is by text 


message on Target Account 3. 


BACKGROUND CONCERNING EMAIL 
82. In my training and experience, I have learned the Providers provide a variety of 


on-line services, including electronic mail (“email”) to the public. The Providers allow 
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subscribers to obtain email accounts at the domain names identified in the email address 
contained in Attachment A and C. Subscribers obtain an account by registering with the 
Providers. During the registration process, the Providers ask subscribers to provide basic 
personal information. Therefore, the computers of the Providers are likely to contain stored 
electronic communications (including retrieved and unretrieved email) for their subscribers and 
information concerning subscribers and their use of services, such as account access information, 
email transaction information, and account application information. In my training and 
experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

83. In my training and experience, email Providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

84. In my training and experience, email Providers typically retain certain 
transactional information about the creation and use of each account on their systems. This 
information can include the date on which the account was created, the length of service, records 
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account 


(including whether the account is inactive or closed), the methods used to connect to the account 
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(such as logging into the account via the Providers’ website), and other log files that reflect 
usage of the account. In addition, email Providers often have records of the Internet Protocol 
address (“IP address”) used to register the account and the IP addresses associated with particular 
logins to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

85. In my training and experience, in some cases, email account users will 
communicate directly with an email service Providers about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. Email Providers 
typically retain records about such communications, including records of contacts between the 
user and the Providers’ support services, as well as records of any actions taken by the Providers 
or user as a result of the communications. In my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. 

86. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 


as date and time) may indicate who used or controlled the account at a relevant time. Further, 
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information maintained by the email Providers can show how and when the account was 
accessed or used. For example, as described below, email Providers typically log the Internet 
Protocol (IP) addresses from which users access the email account, along with the time and date 
of that access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time (e.g., location information integrated into an image or video sent 
via email). Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime (e.g., 
communications relating to the crime), or consciousness of guilt (e.g., deleting communications 
in an effort to conceal them from law enforcement). 

87. In my training and experience, information such as search history can help to 
show the state of mind of an individual at the time the search was made, as well as the 
individuals potential advance knowledge of events, as they search to see if the anticipated event 


has occurred. 


INFORMATION REGARDING APPLE ID AND iCLOUD’ 


7 The information in this section is based on information published by Apple on its website, including, but 
not limited to, the following document and webpages: “U.S. Law Enforcement Legal Process Guidelines,” available 
at http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf; “Create and start using an Apple ID,” 
available at https://support.apple.com/en-us/HT203993; “iCloud,” available at http://www.apple.com/icloud/; “What 
does iCloud back up?,” available at https://support.apple.com/kb/PH12519; “iOS Security,” available at 
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88. Apple is a United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 


the Mac OS operating system. 


89. Apple provides a variety of services that can be accessed from Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

a. Apple provides email service to its users through email addresses at the 
domain names mac.com, me.com, and icloud.com. 

b. iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (“iMessages”) 
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to 
conduct video calls. 

i: iCloud is a file hosting, storage, and sharing service provided by Apple. 
iCloud can be utilized through numerous iCloud-connected services, and can also be used to 
store iOS device backups and data associated with third-party apps. 

d. iCloud-connected services allow users to create, store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and 


manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 


https://www.apple.com/business/docs/iOS Security Guide.pdf, and “iCloud: How Can I Use iCloud?,” available at 
https://support.apple.com/Kkb/PH26502. 
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to share those images and videos with other Apple subscribers. iCloud Drive can be used to 
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable 
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers 
on all of the user’s Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers, 
Keynote, and Notes), enables iCloud to be used to create, store, and share documents, 
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and 
passwords, credit card information, and Wi-Fi network information synchronized across multiple 
Apple devices. 

e. Game Center, Apple’s social gaming network, allows users of Apple 
devices to play and share games with each other. 

È Find My iPhone allows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. Find My 
Friends allows owners of Apple devices to share locations. 

g. Location Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. 

h. App Store and iTunes Store are used to purchase and download digital 
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or 
through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS. Additional digital content, including music, movies, and television shows, can be 
purchased through iTunes Store on iOS devices and on desktop and laptop computers running 


either Microsoft Windows or Mac OS. 
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90. Apple services are accessed through the use of an “Apple ID,” an account created 
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 
syncing mechanism. 

gl. An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 
associated with an Apple ID by the user. 

92. Apple captures information associated with the creation and use of an Apple ID. 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers. The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgot” pages on 
Apple’s website. In addition, Apple captures the date on which the account was created, the 
length of service, records of log-in times and durations, the types of service utilized, the status of 
the account (including whether the account is inactive or closed), the methods used to connect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access 


the account, and other log files that reflect usage of the account. 
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93. Additional information is captured by Apple in connection with the use of an 
Apple ID to access certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 
invitation logs” for FaceTime calls, “query logs” for iMessage, and “mail logs” for activity over 
an Apple-provided email account. Records relating to the use of the Find My iPhone service, 
including connection logs and requests to remotely lock or erase a device, are also maintained by 
Apple. 

94. Apple also maintains information about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“ICCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, including the Media Access Control address (“MAC 
address”), the unique device identifier (“UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
captured when used to access services through icloud.com and apple.com. Apple also retains 
records related to communications between users and Apple customer service, including 
communications regarding a particular Apple device or service, and the repair history for a 


device. 
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95. Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, including: email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and 
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain). 
iCloud can also be used to store iOS device backups, which can contain a user’s photos and 
videos, iMessages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call history, contacts, calendar events, reminders, 
notes, app data and settings, Apple Watch backups, and other data. Records and data associated 
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an 
instant messaging service, can be configured to regularly back up a user’s instant messages on 
iCloud Drive. Some of this data is stored on Apple’s servers in an encrypted form but can 


nonetheless be decrypted by Apple. 


96. In my training and experience, evidence of who was using an Apple ID and from 
where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 


suspicion. 


INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 
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IT. Į anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the accounts in Attachment A, C, and 
E and particularly described in Section I of Attachment B, D, and F. Upon receipt of the 
information described in Section I of Attachments B, D, and F, government-authorized persons 
will review that information to locate the items described in Section II of Attachment B, D, and 
F. The items identified in Attachments A-F will also be screened by reviewers not on the 
prosecution team to identify and filter out privileged material. 

CONCLUSION 

98. Based on the forgoing, I request that the Court issue the proposed search warrant. 

99. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

100. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Andrew Mitchell 
Special Agent 
Federal Bureau of Investigation 


43 


Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 51 of 189 


Subscribed and sworn to before me on this.” _ day of August, 2018, 


, Fá 
MA e ILA r 
AQ D A ENa 
EARL A / 
The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the email address: 


created or maintained between September 11, 2017 and present, that is stored at premises owned, 
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered 


at One Microsoft Way, Redmond, WA 98052. 
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ATTACHMENT B 
Particular Things to be Seized 


I. Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 


a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


b. All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 


c. All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above in Section I.A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 


e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 


f. Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 


g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 
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II. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1, 
2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible in any way to 


communications or meetings involving Jerome “| Julian Assange, 
Randy Credico, or any individual 


associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 
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i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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ATTACHMENT C 
Property to be Searched 


This warrant applies to information associated with the following Google account: 


created or maintained between October 17, 2017 and the present, that is stored at premises 
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at 


1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT D 
Particular Things to be Seized 


I. Files and Accounts to be produced by Google, Inc. 


To the extent that the information described in Attachment C is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment C: 


a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


b. All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 


ron All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 


e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 


f All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 


g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section IL.A.; 


h. Google+ subscriber information, circle information, including name of 
circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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i. Google Drive files created, accessed or owned by the account; 


j. YouTube subscriber information, private videos and files, private 
messages, and comments; 


k. Google+ Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 


L. Google Talk and Google Hangouts conversation logs associated with the 
account. 
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I. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment C which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome coi, Julian Assange, 
andy Credico, or any individual 
associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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ATTACHMENT E 
Property to be Searched 


This warrant applies to information associated with the following Apple DSID: 


created or maintained between March 14, 2018 and the present, that is stored at premises owned, 
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino, 


California 95014. 
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ATACHMENT F 
Particular Things to be Seized 


I. Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment E is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, tiles, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment E: 


a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 


b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (“‘UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (‘IMST’), and International Mobile 
Station Equipment Identities (“IMEI”); 


By The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 


d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 


f All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mai! logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 


g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 


h. All records pertaining to the types of service used; 


fl All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 


j. All files, keys, or other information necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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II. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome cos Julian Assange, 
aay Randy Credico, or any individual 
associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 


District of Columbia 


In the Matter of the Search of 
(Briefly describe the property to be searched Case: 1:1 8-sc-02582 
or identify the person by name and address) Assigned To : Howell, Beryl A. 


) 
) 
) . 
INFORMATION ASSOCIATED WITH THREE ) Assign. Date : 8/3/2018 — 
ACCOUNTS STORED AT PREMISES CONTROLLED ) Description: Search & Seizure Warrant 
BY MICROSOFT, GOOGLE, AND APPLE ) 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property locatedinthe _ Western District of Washington 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before August 15, 2018 (not to exceed 14 days) 
in the daytime 6:00 a.m. to 10:00 p.m. O at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) C until, the facts justifying, the later specific date of 


Date and time issued: A 2 FA g af 2l A eZ, PEE A Lee 


Judge's signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


~ Printed name and title 
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Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the email address: 


created or maintained between September 11, 2017 and present, that is stored at premises owned, 
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered 


at One Microsoft Way, Redmond, WA 98052. 
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ATTACHMENT B 
Particular Things to be Seized 


I. Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 


a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


b. All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 


c. All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above in Section I.A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 


e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 


f. Records or other information regarding the identification of the account described above 
in Section L.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in JP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 


g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 
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I. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1, 
2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


nications or meetings involving Jerome Corsi, = UG Assange, 
andy Credico, or any individual 


associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence ofthe times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 
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i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


FILED 
UNITED STATES DISTRICT COURT 4) 
AUG - 3 29 


for the Clerk, U.S i 
District of Columbia Courts for fa Dhue ce pey 
2 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 
INFORMATION ASSOCIATED WITH THREE ACCOUNTS 
STORED AT PREMISES CONTROLLED BY MICROSOFT, 


GOOGLE, AND APPLE 


Case: 1:18-sc-02582 

Assigned To : Howell, Beryl A. 

Assign. Date : 8/3/2018 

Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property to be searched and give its location): 
See Attachment A 


located in the Western Districtof Washington ___, there is now concealed (identify the 


person or describe the property to be seized): 


See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
WM evidence of a crime; 
Sf contraband, fruits of crime, or other items illegally possessed; 
i property designed for use, intended for use, or used in committing a crime; 


O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 


18 U.S.C. §§ 1505, 1512, 1513 Obstruction of justice, Witness tampering 
18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 


See Affidavit for add'l 


The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: _ ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attache sheet. 


Reviewed by AUSA/SAUSA: Applicant’s signature 
Aaron Zelinsky (ASC) o Andrew Mitchell, Special Agent, FBI 
Printed name and title 


Sworn to before me and signed in my presence. 


Date: r A f D /2 ' < Za g A- Aa AD 


Judge's signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 


City and state: Washington, D.C. 
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FILED 
AUG ~ 3 20%8 


Clerk, U.S. District & Bankruptey 


Courts f ; 
IN THE UNITED STATES DISTRICT COURT erts Tor the District of Cotumbla 


FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
THREE ACCOUNTS STORED AT 


Case: 1:18-sc-02582 
Assigned To : Howell, Beryl A. 


PREMISES CONTROLLED BY Assign. Date : 8/3/2018 _ 
MICROSOFT, GOOGLE, AND APPLE Description: Search & Seizure Warrant 
AFFIDAVIT IN SUPPORT OF 


AN APPLICATION FOR A SEARCH WARRANT 
I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

be I make this affidavit in support of an application for a search warrant for 
information associated with the following: 

a. The email = Q “Target Account 1), that is 
stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with 
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be 
disclosed by Microsoft and searched by the government is described in the following paragraphs 
and in Attachments A and B. 

b. The email account | “Target Account 2”), that is 
stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with 
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The 
information to be disclosed by Google and searched by the government is described in the 


following paragraphs and in Attachments C and D. 


c. The iCloud account {TTT ssocietea with the Apple email account 
ae: “Target Account 3”), that is stored at premises owned, 
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maintained, controlled, or operated by Apple, Inc., a business with offices located at 1 Infinite 
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by 
the government is described in the following paragraphs and in Attachment E and F. 

2 I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation 
(FBI), and have been since 2011. Asa Special Agent of the FBI, I have received training and 
experience in investigating criminal and national security matters. 

oe The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4, Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain communications relevant to 
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 
(misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 
U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512 
(obstruction of justice), 18 U.S.C. § 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign 
contribution ban) (the “Subject Offenses”). 

S; On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for Roger STONE’s O ë R 


Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE’s 


i= wA —— (Target Account 2). On or about March 14, 2018, Chief 


Judge Howell issued a search warrant for STONE’s iCloud account (Target Account 3). This 


2 
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warrant seeks to search those accounts from the date each respective warrant was issued to the 
present. 
JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. s$ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraphs 14, 19, and 61. 
SUMMARY 

Ts This application seeks authority to search, from the date of search warrants 
previously issued by the Court to the present, three accounts believed to be used by Roger 
STONE: Target Account 1, which is STONE’s BE count Target Account 2, which is 
STONE’s BR «coun: and Target Account 3, which is STONE’s iCloud account. As set 
forth herein, there is probable cause to believe that each of the Subject Accounts contains 
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with 
witnesses, and make false statements. 

8. For example, as set forth in more detail below, in recent months STONE has 
reached out to communicate with multiple witnesses he knew or had reason to believe were 
scheduled to testify before Congress about interactions with STONE during the 2016 presidential 
campaign or were scheduled to meet with the Special Counsel’s Office and/or appear before the 
Grand Jury investigating such interactions. After STONE learned that one witness, Randy 


CREDICO, was prepared to contradict STONE’s congressional testimony, STONE repeatedly 
3 


Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 74 of 189 


urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so 


through multiple text messages. In June 2018, STONE instructed his private investigator to 


provide him with a full background investigation on another witness fi g had 


done information technology work for STONE during the campaign 


9; In September 2017, STONE released a statement he said he provided to Congress 
in which he denied having advance knowledge of “the source or actual content of the Wikileaks 
disclosures regarding Hillary Clinton.” He also stated publicly that when he tweeted during the 
campaign, on August 21, 2016, “it will soon the Podesta’s time in the barrel,” he was not 
referring to the hacking or publication of John Podesta’s emails, but rather. to “Podesta’s business 
dealings with Russia.” Evidence obtained in the investigation, however, shows the following: 

a. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to “Get 
to Assange” at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” Julian 
ASSANGE is the founder of WikiLeaks. On or about July 31, 2016, STONE also instructed 
CORSI to have as contact ASSANGE. On or about August 2, 2016, CORSI 
responded to STONE that the “[w]Jord is friend in embassy plans 2 more dumps. One shortly 
after I’m back. 2nd in Oct. Impact planned to be very damaging.... Time to let more than 
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC.” After receipt of 
that message, on or about August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, 
it will soon the Podesta’s time in the barrel. #CrookedHillary.” 

b. Information disclosures subsequently occurred on or about the times 
CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the 


United States (“shortly after I’m back”), Guccifer 2.0 released hacked information related to the 


4 
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Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day 
the Washington Post published a breaking story about an Access Hollywood videotape of then- 
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked 
from the account of John Podesta. 

cor Furthermore, on the day of the Access Hollywood video disclosure, there 
were phone calls between STONE and CORSI after the Washington Post contacted STONE 
prior to publication. At approximately 11:00AM, the Washington Post received a tip regarding 
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE 
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM, 
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called 
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post 


published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks 


tweeted out its first release of emails hacked from John Podesta. 
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PROBABLE CAUSE. 


A. Background on Relevant Individuals 
i. Roger STONE 
10. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii, Jerome CORSI 
11. | Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a ““WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. U.S. Intelligence Community Assessment of Russian Government-Backed Hacking 
Activity during the 2016 Presidential Election 


13. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 
the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following: 

a. The U.S. Intelligence Community (“USIC”) is confident that the Russian 
Government directed the recent compromises of emails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked emails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 


with the methods and motivations of Russian-directed efforts. These thefts and disclosures were 
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intended to interfere with the U.S. election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

14. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

a. “Russian President Vladimir Putin ordered an influence campaign in 2016 
aimed at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

b. The USIC also described, at a high level, some of the techniques that the 
Russian government employed during its interference. The USIC summarized the efforts as a 
“Russian messaging strategy that blends covert intelligence operations—such as cyber activity— 
with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

om With respect to “cyber activity,” the USIC assessed that “Russia’s 
intelligence services conducted cyber operations against targets associated with the 2016 US 
presidential election, including targets associated with both major US political parties.” Further, 
“Tijn July 2015, Russian intelligence gained access to Democratic National Committee (DNC) 


networks and maintained that access until at least June 2016.” The USIC attributed these cyber 
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activities to the Russian GRU, also known as the Main Intelligence Directorate: “GRU 
operations resulted in the compromise of the personal e-mail accounts of Democratic Party 
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the 
DNC.” The GRU is the foreign military intelligence agency of the Russian Ministry of Defense, 
and is Russia’s largest foreign intelligence agency. 

d. With respect to the release of stolen materials, the USIC assessed “with 
high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

€: Guccifer 2.0, who claimed to be an independent Romanian hacker, made 
multiple contradictory statements and false claims about his identity throughout the election. 

C. Additional Hacking Activity by Individuals Associated with the GRU 

15. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 campaign through at least 
November 1, 2016. 

16. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the. “snapshots” to 
those accounts. 

17. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 


emails were later posted on DCLeaks. 
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18. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

19. On or about July 13, 2018, a grand jury in this District indicted eleven GRU 
officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons 
and entities involved in the 2016 U.S. presidential election, steal documents from those 
computers, and stage releases of stolen documents in order to interfere with the election. The 
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign 
Committee (“DCCC”), and the chairman of the Clinton campaign (John Podesta). See United 
States v. Viktor Borisovich Netyksho, et al. (1:18-cr-215) (D.D.C.).! 

D. Roger STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

20. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors. The media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

21. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 


the DNC. 


1 A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for 
administering elections, including state boards of election, secretaries of state, and companies that supply software 
and other technology used to administer elections. 
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22. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’!I see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world 
would see for themselves how the Democrats had rigged the game.” 

23. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by ASSANGE to Russia 
Today (RT) several days earlier about an upcoming “October Surprise” aimed at the Hillary 
Clinton presidential campaign. Specifically, STONE was asked: “With regard to the October 
surprise, what would be your forecast on that given what Julian Assange has intimated he’s 
going to do?” STONE responded: “Well, it could be any number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, STONE 
clarified that while he was not personally in touch with ASSANGE, he had a close friend who 
served as an intermediary. 

24. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

25. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 


2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
11 
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Twitter account was reinstated. 

26. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

27. On August 18, 2016, Paul Manafort, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. 

28. As noted above, on August 21, 2016, using @RogerJStoneJR, STONE tweeted: 
“Trust me, it will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN 
interview that same day, STONE reiterated that because of the work of a “‘mutual acquaintance’ 
of both his and [ASSANGE], the public [could] expect to see much more from the exiled 
whistleblower in the form of strategically-dumped Clinton email batches.” He added: “Well, 
first of all, I think Julian Assange is a hero... I think he’s taking on the deep state, both 
Republican and Democrat. I believe that he is in possession of all of those emails that Huma 
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are 
like the Watergate tapes.” 

29. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

30. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

31. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 


tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
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of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

32. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

33. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

34. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 


35. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
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from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

E. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

36. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 

Twitter account @RogerJStoneJr. Information recovered from the search of that account 
includes the following: 

a. On October 13, 2016, while WikiLeaks was in the midst of releasing the 
hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

b. Less than an hour later, @wikileaks responded by direct message: “We 
appreciate that. However, the false claims of association are being used by the democrats to 
undermine the impact of our publications. Don’t go there if you don’t want us to correct you.” 

Ç. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 


operation leaks like a sieve. You need to figure out who your friends are.” 
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d. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

ê In addition, @RogerJStoneJr also exchanged direct messages with 
ASSANGE. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

f. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 


this forum as experience demonstrates it is monitored. Best regards R.” 
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F. STONE’s Communications with stor, and Others Regarding 


Forthcoming Leaks 
Ete As indicated above, on September 11, 2017, Chief Judge Howell issued a search 


warrant for srone EE sf ë ë Account 1); on 


October 17, 2017, Chief Judge Howell issued a search warrant for STONE’s BE «cress, 
ae: Account 2); and on or about March 14, 2018, Chief Judge 
Howell issued a search warrant for STONE’s iCloud account (Target Account 3). In addition, 
on or about December 19, 2017, Chief Judge Howell issued a search warrant for MALLOCH’s 
email account. Information recovered pursuant to those search warrants includes the following: 

a. On or about May 15, 2016, | CORSI: “Here is my 
flight schedule. Need to get something confirmed now... .” CORSI responded, “I copied 
Roger Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI 
that, “May meet Manafort -guarantee nothing.” 

b. On or about May 18, 2016, CORSI emailed STONE at Target Account 1 


with the title, “Roger -- why don’t you look this over before I send s Ot believe that 


CORSI wrote, 


nd I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

C. On July 25, 2016, STONE, using Target Account 1, sent an email to 


CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
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[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

d. On or about July 31, 2016, STONE, using Target Account 1, emailed 
CORSI with the subject line, “Call me MON.” The body of the email read: | see 
Assange[.] | ES find Bernie [S]anders brother who called Bill a Rapist — turn him for 
Tromp should in iii or more proof of Bill getting kicked out.” 

e. As noted above, on or about August 2, 2016 (approximately 19 days 
before STONE publicly tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE 
at Target Account 1: “Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued: “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect 
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more 
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears 
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory 
bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage 
for Foundation debacle.” Investigators believe that CORSI’s reference to a “friend in embassy 


[who] plans 2 more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 


f. On or about August 5, Za o an associate of STONE’s, 


emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton 


2016. 


led Trump by 15 points. STONE responded, “enjoy it while u can{.] I dined with my new pal 


Julian Assange last night.” | ie stated to investigators that, around the 
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same time, STONE told him he had gone to London to meet ASSANGE. O S stated 
that in -a told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE w was joking and 
had not actually met ASSANGE.’ 


g. On or about August 15, 2016, CORSI emailed STONE at Target Account 
1: “Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it’s not 
over yet. More to come than anyone realizes. Won’t really get started until after Labor Day. I’m 
in NYC this week. Jerry.” 

h. On or about August 31, 2016, CORSI emailed STONE at Target Account 
1: “Did you get the PODESTA writeup.” STONE replied “[y]es.” 

i. On or about August 31, 2016, CORSI messaged STONE at Target 
Account 3, “Podesta paid $180k to invest in Uranium One — was hired by Rosatom in Giustra 
scandal. Podesta now under FBI investigation — tied to Ukraine Yanukovych — Panama papers 
reveals Podesta hired by S[bJerbank, Russia’s largest financial institution — Podesta $$$ ties to 
Russia undermine Clinton false narrative attempting to tie Trump to Putin.” 

j. On or about September 6, 2016, CORSI emailed STONE at Target 


Account 1: “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 


k. On or about September 24, 2016 E CORSI, “I will 


have much more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, 
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“We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to 
him about it again coday.” I ote back, “Awaiting secret file. Explosive... Hope you 
are well. Can’t wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me 
posted about file[.]” In a subsequent meeting with investigators incicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

l. On or about October 3, 2016, an associate of STONE emailed STONE at 
Target Account 2 and asked: “Assange — what’s he got? Hope it’s good.” STONE wrote back, 
“It is. ’'d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will be 
out in Jan. Many scores will be settled.” The associate forwarded the email to Steve BANNON, 
who was CEO of the Campaign at the time, and wrote: “You should call Roger. See below. You 
didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry about.” The 
associate responded, “Well clearly he knows what Assange has. Pd say that’s important.” 

m. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

n. On or about October 4, 2016, CORSI messaged STONE at Target 


Account 3, “Assange made a fool of himself. Has nothing or he would have released it. Total 


BS hype.” 
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o. That same day, BANNON emailed STONE at Target Account 2, “What 
was that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are 
going to kill him and the London police are standing done [sic].” BANNON wrote back, “He 
didn’t cut deal w/ clintons???” STONE replied, “Don’t think so BUT his lawyer) is a 
big democrat.” 

p. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released 


38. According to a publicly available news article,’ at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood’ and NBC for reaction.” 


39. According to phone records S at approximately 


11:27 AM, CORSI placed a call to STONE which STONE did not answer. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was- 
on/2016/10/07/3 1d74714-8ce5-11e6-875e-2c 1 bfe943b66_story.html 
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40. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

41. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

42. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

43. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

44. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, “I expect that much 
of next dump focus, setting stage for Foundation debacle.” 

45. At approximately or an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target 
Account 2, forwarded ae message to CORSI without comment. STONE does not appear 


to have forwarded the email to any other individual. 


H. STONE Asks CORSI for “SOMETHING?” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


46. On or about October 8, 2016, STONE, using Target Account 3, messaged 
CORSI, “Lunch postponed — have to go see T.” CORSI responded to STONE, “Ok. I 


understand.” Approximately twenty minutes later, CORSI texted, “Clintons know they will lose 
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a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs 
speech comments, attacking bad job numbers.” 

47. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
using Target Account 2, emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM, “need your BEST podesta pieces.” CORSI 
wrote back at approximately 8:54AM, “Ok. Monday. The remaining stuff on Podesta is 
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian 
translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

48. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM, 
CORSI emailed STONE at both Target Account 1 and 2 with the subject line “Podesta talking 
points.” Attached to the email was a file labeled, “ROGER STONE podesta talking points Oct 
12 2016.docx.” The “talking points” included the statement that “Podesta is at the heart of a 
Russian-government money laundering operation that benefits financially Podesta personally and 
the Clintons through the Clinton Foundation.” 

49. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via Target Account 1: “Got them and used them.” 

50. On or about Thursday, October 13, 2016, CORSI emailed STONE at Target 
Account 2: “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to CLINTON 
FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could post under my 
by-line since I am the one under attack by Podesta and now Mook.” CORSI wrote back to 


STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me like 
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E skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] we at 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

51. On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent 
STONE an email at Target Account 2, with the subject, “ROGER STONE article RUSSIAN 
MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN 
PODESTA.” The text stated: “Roger[,] You are free to publish this under your own name.” 
That same day, STONE posted a blog post with the title, “Russian Mafia money laundering, the 
Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I have had some 
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr. 
Podesta nor I have I ever received documents or data from Wikileaks.” The post then asked, 
“Just how much money did o £ controversial Russian billionaire investor with 
ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian 
regional bank owned 99.978 percent by Oo i: the money transferred via Deutsche 
Bank and Trust Company Americas in New York City, with the money ending up in a private 
bank account in the Bank of America that is operated by the Clinton Foundation?” 

52; On or about October 14, 2016, CORSI sent a message to STONE at Target 
Account 3, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 


basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 
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53: On or about October 17, 2016, CORSI messaged STONE at Target Account 3, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

54. On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1 
and 2 with the subject, “Fwd: ASSANGE...URGENT...” CORSI wrote, “From a very trusted 
source,” and forwarded an email with the header information stripped out, showing only the 
body text. The email read, “Yesf[.] I figured this. Assange is threatening Kerry, Ecuador and 
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set 
of dead man files that include Hillary. It’s what they used to call a ‘Mexican stand offf. Only 
hope is that if Trump speaks out to save him[.] Otherwise he’s dead anyway, once he’s dropped 
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to 
play out. He’s called Podesta’s bluff and raised him the election.” 

55. On or about October 18, 2016, CORSI messaged STONE at Target Account 3, 
“Pls call. Important.” 

56. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear it 
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 


57. Onor about November 8, 2016, the United States presidential election took place. 
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58. On or about November 9, 2016, CORSI messaged STONE at Target Account 3, 
“Congratulations, Roger. He could not have done it without you.” 
59. On or about November 10, 2016, CORSI messaged STONE at Target Account 3, 


“Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in London. 


Have some interesting news for you.” 


25 


Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 96 of 189 


Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 97 of 189 


J. STONE?’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


61. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. ... 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
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I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 


62. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 

encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange, 

you were only referring to a single fact that you had confirmed with the intermediary — 

MR. STONE: That — 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. 

63. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 


expectation that it would become a news story.” 


K. STONE’s Use of Target Account 3 to Message Randy CREDICO about STONE?’s 
“Back channel” 
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64. On November 19, 2017, Randy CREDICO (who, as described further below, 
STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE on Target 
Account 3, “My lawyer wants to see me today.” STONE responded, ““Stonewall it. Plead the 
fifth. Anything to save the plan’........ Richard Nixon[.]’”” CREDICO responded, “Ha ha.” 

65. On or about November 21, 2017, CREDICO messaged STONE on Target 
Account 3, “I was told that the house committee lawyer told my lawyer that I will be getting a 
subpoena[.]” STONE wrote back, “That was the point at which your lawyers should have told 
them you would assert your 5th Amendment rights if compelled to appear.” They continued to 
message, and CREDICO wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To 
do what ? Nothing happening in DC the day before Thanksgiving — why are u busting my 
chops?” 

66. On or about November 24, 2017, STONE, using Target Account 3, texted 
CREDICO, “Assange is a journalist and a damn good one- meeting with him is perfectly legal 
and all you ever told me was he had the goods [o]n Hillary and would publish them — which he 
himself said in public b4 u told me . It’s a fucking witchunt [sic].” CREDICO replied, “I told 
you to watch his tweets. That’s what I was basing it on. I told you to watch his Tweets in 
October not before that I knew nothing about the DNC stuff[.] I just followed his tweets[.]” 
STONE responded, “U never said anything about the DNC but it was August.” CREDICO 
wrote back, “It was not August because I didn’t interview him or meet him until August 26th[.] 
That was my first communication with his secretary in London, August 26th.” STONE wrote 


back, “Not the way I remember it — oh well I guess Schiff will try to get one of us indicted for 


perjury[.]” 
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67. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on November 24, 2017, CREDICO wrote to STONE, “Forensic evidence proves that there is 
no back Channel. So now you can relax.” 

68. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

69. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that, “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 
content of the material.” 

70. On or about December 1, 2017, CREDICO messaged STONE on Target 
Account 3, stating, “I don’t know why you had to lie and say you had a back Channel now I had 
to give all of my forensic evidence to the FBI today what a headache[.]* You could have just told 
him the truth that you didn’t have a back Channel they now know that I was not in London until 
September of this year[.] You had no back-channel and you could have just told the truth... 
You want me to cover you for perjury now[.]” STONE responded, “What the fuck is your 
problem? Neither of us has done anything wrong or illegal. You got the best press of your life 


and you can get away with asserting for Sth Amendment rights if u don’t want talk about AND if 


4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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you-turned over anything to the FBI you’re a fool.” CREDICO responded, “You open yourself 
up to six counts of perjury[.] But I’m sure that wasn’t sworn testimony so you're probably 
clear[.] Council for the committee knows you never had a back Channel and if you had just told 
the truth wouldn’t have put me in this bad spot . . . you should go back . . . and amend your 
testimony and tell them the truth.” CREDICO repeated: “you need to amend your testimony 
before I testify on the 15th.” STONE replied, “If you testify you’re a fool. Because of tromp 
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I 
guarantee you you [sic] are the one who gets indicted for perjury if you’re stupid enough to 
testify[.]” 

71. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

72. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

73. | STONE and CREDICO continued to exchange messages via Target Account 3, 
and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with 
a reporter. STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” 
CREDICO messaged STONE, “I have the email from his chief of staff August 25th 2016 
responding to an email I sent to WikiLeaks website emai! address asking you would do my 


show[.] That was my initial contact.” 
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74. Onor about January 8, 2018, CREDICO messaged STONE on Target Account 3 
stating: “Embassy logs... + 17 other pieces of information prove that I did not have any 
conversations with Assange until September of last year.” 

TD: CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE on Target Account 3: “You lied to the house Intel 
committee . . . But you’ll get off because you’re friends with Trump so don’t worry. I have all 
the forensic evidence[.] I was not a ba[ck] Channel and I have all those emails from September 
of 2016 to prove it[.]” 

76. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You area stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you start bringing up my dog, you’re crossing the linef.]”° 

77. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.° In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 


me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog- 
135911370. html 


6 https://www.motherjones.com/politics/20 1 8/05/roger-stone-to-associate-prepare-to-die/ 
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He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 


L. STONE’s Use of the Target Accounts to Communicate with Individuals Related to 
the Investigation 


78. On May 17, 2018, Chief Judge Howell issued an order for the use of pen-trap 
devices on Target Account 1 and Target Account 2. The information obtained from that order, 
along with information obtained from toll records, revealed that STONE has continued to use 
Target Account 1 and Target Account 2, and that he has used them to communicate with 


individuals related to the investigation. 


79. For example, STONE and ommunicated twice on May 28 and May 


29, 2018 using Target Account 1. a former associate of STONE’ s, was 
interviewed by the Special Counsel’s Office on or about May 2, 2018. Toll records show that 
o g STONE communicated multiple times on May 5, 2018, and STONE 


communicated with RE sing Target Account 1 on June 1, 2018 and June 6, 2018. = 


iT a private investigator who had previously worked with STONE and who was hired 
by STONE to research individuals associated with this case (as described further below), 
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and 
July 12, 2018. 

80. | STONE has also used Target Account 2 to communicate with individuals 
associated with this investigation. 

a. For example, between May 23, 2018 and the present, STONE and CORSI 

exchanged at least five messages using Target Account 2. In the same time period, STONE 


exchanged at least 75 emails with CREDICO using Target Account 2. 
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b. Also in this same time period, STONE emailed a: least 


ten times using Target Account 3 g a former employee of STONE. On May 9, 


2018, FBI agents approached E ee That day, 
and again on May 10, 201 Be communicated by phone with 


STONE. Overall, between May 23, 2018 and the present, STONE exchanged over 100 emails 


wit TE «io. Target Account 2. In addition, between on or about June 14, 2018 and 


June 17, 2018, 


and STONE exchanged five emails using Target Account 2. 


81. STONE has also used a phone number associated with Target Account 3 to 
communicate with i a private investigator hired by STONE. ae: 
interviewed by investigators on June 7, 2018, and subsequently informed investigators that in 
June 2018, STONE instructed him to conduct a full background investigation iim 


re. had been employed by STONE during the Campaign as an information technology 
cil ll à OO 
B told investigators that in June 2018, STONE instructed him to find 


an address for CREDICO that could be used to serve CREDICO with legal process. 


= Q investigators that his primary form of communication with STONE is by text 


message on Target Account 3. 


BACKGROUND CONCERNING EMAIL 
82. In my training and experience, I have learned the Providers provide a variety of 


on-line services, including electronic mail (“email”) to the public. The Providers allow 
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subscribers to obtain email accounts at the domain names identified in the email address 
contained in Attachment A and C. Subscribers obtain an account by registering with the 
Providers. During the registration process, the Providers ask subscribers to provide basic 
personal information. Therefore, the computers of the Providers are likely to contain stored 
electronic communications (including retrieved and unretrieved email) for their subscribers and 
information concerning subscribers and their use of services, such as account access information, 
email transaction information, and account application information. In my training and 
experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

83. In my training and experience, email Providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

84. In my training and experience, email Providers typically retain certain 
transactional information about the creation and use of each account on their systems. This 
information can include the date on which the account was created, the length of service, records 
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account 


(including whether the account is inactive or closed), the methods used to connect to the account 
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(such as logging into the account via the Providers’ website), and other log files that reflect 
usage of the account. In addition, email Providers often have records of the Internet Protocol 
address (“IP address”) used to register the account and the IP addresses associated with particular 
logins to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

85. In my training and experience, in some cases, email account users will 
communicate directly with an email service Providers about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. Email Providers 
typically retain records about such communications, including records of contacts between the 
user and the Providers’ support services, as well as records of any actions taken by the Providers 
or user as a result of the communications. In my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. 

86. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 


as date and time) may indicate who used or controlled the account at a relevant time. Further, 
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information maintained by the email Providers can show how and when the account was 
accessed or used. For example, as described below, email Providers typically log the Internet 
Protocol (IP) addresses from which users access the email account, along with the time and date 
of that access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time (e.g., location information integrated into an image or video sent 
via email). Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime (e.g., 
communications relating to the crime), or consciousness of guilt (e.g., deleting communications 
in an effort to conceal them from law enforcement). 

87. In my training and experience, information such as search history can help to 
show the state of mind of an individual at the time the search was made, as well as the 
individuals potential advance knowledge of events, as they search to see if the anticipated event 


has occurred. 


INFORMATION REGARDING APPLE ID AND iCLOUD’ 


$ The information in this section is based on information published by Apple on its website, including, but 
not limited to, the following document and E “U.S. Law Enforcement Legal Process Guidelines,” available 
suidelines-us.pdf; “Create and start using an Apple ID,” 
available at ht tii easier: apple.com/en-us/HT203993; “iCloud,” available at http://www.apple.com/icloud/; “What 
does iCloud back up?,” available at https://support.apple.coni/kb/PH12519; “iOS Security,” available at 
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88. Apple is a United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 


the Mac OS operating system. 


89. Apple provides a variety of services that can be accessed from Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

a. Apple provides email service to its users through email addresses at the 
domain names mac.com, me.com, and icloud.com. 

b. iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (“iMessages”) 
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to 
conduct video calls. 

c. iCloud is a file hosting, storage, and sharing service provided by Apple. 
iCloud can be utilized through numerous iCloud-connected services, and can also be used to 
store iOS device backups and data associated with third-party apps. 

d. iCloud-connected services allow users to create, store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and 


manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 


https://www.apple.com/business/docs/iOS_ Security _Guide.pdf, and “iCloud: How Can I Use iCloud?,” available at 
https://support.apple.com/kb/PH26502. 
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to share those images and videos with other Apple subscribers. iCloud Drive can be used to 
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable 
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers 
on all of the user’s Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers, 
Keynote, and Notes), enables iCloud to be used to create, store, and share documents, 
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and 
passwords, credit card information, and Wi-Fi network information synchronized across multiple 
Apple devices. 

e. Game Center, Apple’s social gaming network, allows users of Apple 
devices to play and share games with each other. 

f. Find My iPhone allows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. Find My 
Friends allows owners of Apple devices to share locations. 

g. Location Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. 

h. App Store and iTunes Store are used to purchase and download digital 
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or 
through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS. Additional digital content, including music, movies, and television shows, can be 
purchased through iTunes Store on iOS devices and on desktop and laptop computers running 


either Microsoft Windows or Mac OS. 
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90. Apple services are accessed through the use of an “Apple ID,” an account created 
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 
syncing mechanism. 

91. An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 
associated with an Apple ID by the user. 

92. Apple captures information associated with the creation and use of an Apple ID. 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers. The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgot” pages on 
Apple’s website. In addition, Apple captures the date on which the account was created, the 
length of service, records of log-in times and durations, the types of service utilized, the status of 
the account (including whether the account is inactive or closed), the methods used to connect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access 


the account, and other log files that reflect usage of the account. 
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93. Additional information is captured by Apple in connection with the use of an 
Apple ID to access certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 
invitation logs” for FaceTime calls, “query logs” for iMessage, and “mail logs” for activity over 
an Apple-provided email account. Records relating to the use of the Find My iPhone service, 
including connection logs and requests to remotely lock or erase a device, are also maintained by 
Apple. 

94. Apple also maintains information about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“JCCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, including the Media Access Control address (“MAC 
address”), the unique device identifier (“UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
captured when used to access services through icloud.com and apple.com. Apple also retains 
records related to communications between users and Apple customer service, including 
communications regarding a particular Apple device or service, and the repair history for a 


device. 
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95; Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, including: email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and 
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain). 
iCloud can also be used to store iOS device backups, which can contain a user’s photos and 
videos, iMessages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call history, contacts, calendar events, reminders, 
notes, app data and settings, Apple Watch backups, and other data. Records and data associated 
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an 
instant messaging service, can be configured to regularly back up a user’s instant messages on 
iCloud Drive. Some of this data is stored on Apple’s servers in an encrypted form but can 


nonetheless be decrypted by Apple. 


96. In my training and experience, evidence of who was using an Apple ID and from 
where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 


suspicion. 


INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 
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97. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the accounts in Attachment A, C, and 
E and particularly described in Section I of Attachment B, D, and F. Upon receipt of the 
information described in Section I of Attachments B, D, and F, government-authorized persons 
will review that information to locate the items described in Section II of Attachment B, D, and 
F. The items identified in Attachments A-F will also be screened by reviewers not on the 
prosecution team to identify and filter out privileged material. 

CONCLUSION 

98. Based on the forgoing, I request that the Court issue the proposed search warrant. 

99, Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

100. 1 further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Andrew Mitchell 
Special Agent 
Federal Bureau of Investigation 
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p 
/ 
A 


Subscribed and sworn to before me on we day of August, 2018. 


j Hd, / F pj PIA 
APN A-A Ave/ 
I 
The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the email address: 


created or maintained between September 11, 2017 and present, that is stored at premises owned, 
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered 


at One Microsoft Way, Redmond, WA 98052. 
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ATTACHMENT B 
Particular Things to be Seized 


I. Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 


a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


b. All existing printouts from original storage of all of the electronic mail described above 
in Section L.A. above; 


c. All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above in Section LA, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 


e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 


f. Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 


g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 
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IL. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1, 
2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome Corsi, Julian Assange, 

Randy Credico, or any individual 
associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 
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j. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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ATTACHMENT C 


Property to be Searched 


This warrant applies to information associated with the following Google account: 


created or maintained between October 17, 2017 and the present, that is stored.at premises 
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at 


1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT D 
Particular Things to be Seized 


I. Files and Accounts to be produced by Google, Inc. 


To the extent that the information described in Attachment C is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment C: 


a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


b. All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 


c. All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 


Š; All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 


f. All records or other information regarding the identification of the account 
described above in Section LA, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 


g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section I.A.; 


h. Google+ subscriber information, circle information, including name of 
circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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i. Google Drive files created, accessed or owned by the acċount; 


je YouTube subscriber information, private videos and files, private 
messages, and comments; 


k. Google+ Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 


L. Google Talk and Google Hangouts conversation logs associated with the 
account. 
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I. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment C which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 
Julian Assange, 


communications or meetings involving Jerome Corsi, —_— 
Randy Credico, or any individual 


associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


i. All existing printouts from original storage which concern the categories identified in 
subsection I.a 
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ATTACHMENT E 
Property to be Searched 


This warrant applies to information associated with the following Apple DSID: 


created or maintained between March 14, 2018 and the present, that is stored at premises owned, 
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino, 


California 95014. 
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ATACHMENT F 
Particular Things to be Seized 


I. Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment E is within the possession, 
custody, or contro! of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, files, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment E: 


a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 


b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (‘UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (‘IMST’), and International Mobile 
Station Equipment Identities (“IMEI”); 


c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 


d; The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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€: The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 


f. All activity, conncction, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 


g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 


h. All records pertaining to the types of service used; 


i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 


j. All files, keys, or other information necessary to decrypt any data produced in an 


encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 


55 


Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 126 of 189 


H. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome Corsi, eee Julian Assange, 

II 35. Crocco, or any incividea 
associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 


In the Matter of the Search of ) 
(Briefly describe the property to be searched ) Case: 1: 1 8-sc-02583 
or identify the person by name and address) ) Assig ned To : H owell, Be IA 
) ’ 
) 


INFORMATION ASSOCIATED WITH THREE Assign, Date : 8/3/2018 
ACCOUNTS STORED AT PREMISES CONTROLLED escription: , 
BY MICROSOFT, GOOGLE, AND APPLE ) ption: Search & Seizure Warrant 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California 
(identify the person or describe the property to be searched and give its location): 


See Attachment C 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment D 


YOU ARE COMMANDED to execute this warrant on or before August 15, 2018 (not to exceed 14 days) 
@ in the daytime 6:00 a.m. to 10:00 p.m. Cat any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 


property, will be searched or seized (check the appropriate box) 
© for days (not to exceed 30) © until, the facts justifying, the later specific date of E 


Dats mid fie issual: g7 2/20 IP ù e EA 2 f fh LL B MASIGA 


Judge's signature 


Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 


City and state: 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 


Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 129 of 189 


ATTACHMENT C 


Property to be Searched 


This warrant applies to information associated with the following Google account: 


created or maintained between October 17, 2017 and the present, that is stored at premises 
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at 


1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT D 
Particular Things to be Seized 


I. Files and Accounts to be produced by Google, Inc. 


To the extent that the information described in Attachment C is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment C: 


a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


b. All existing printouts from original! storage of all of the electronic mail 
described above in Section I.A. above; 


G. All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 


e. All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 


f All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 


g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section I.A.; 


h. Google+ subscriber information, circle information, including name of 
circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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j: Google Drive files created, accessed or owned by the account; 


j. YouTube subscriber information, private videos and files, private 
messages, and comments; 


k. Google+ Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 


l. Google Talk and Google Hangouts conversation logs associated with the 
account. 
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Il. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment C which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome Corsi Julian Assange, 


associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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FILED 


AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT 


for the AUG ~ 3 2018 
District of Columbia Clerk, U.S, District & Bunkrupicy 
Courts for the District of Columbia 
In the Matter of the Search of AAC es 
(Briefly describe the property to be searched } Case: 1:18-sc-02583 
or identify the person by name and address) ) Assigned To: -Howell, Be ryl A. 
INFORMATION ASSOCIATED WITH THREE ACCOUNTS j Assign. Date : 8/3/2018 
STORED AT PREMISES CONTROLLED BY MICROSOFT, j Description: s h & Sei W. 
GOOGLE, AND APPLE S p : Searc eizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property to be searched and give its location): 


See Attachment C 


located in the Northern _ District of California , there is now concealed (identify the 
person or describe the property to be seized): 
See Attachment D 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 
© contraband, fruits of crime, or other items illegally possessed; 
& property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 


18 U.S.C. §§ 1505, 1512, 1513 Obstruction of justice, Witness tampering 
18 U.S.C. §§ 1001, 1030,371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 


See Affidavit for add'l 


The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 
O Delayed notice of days (give exact ending date if more than 30 days: 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: Applicant's signature 


) is requested 


Aaron Zelinsky (ASC) Andrew Mitchell, Special Agent, FBI 
Printed name and title 


Sworn to before me and signed in my presence. 


Pai a = mee = A Z A AT 
oe: 813/24 l LBL L ORE” 


Judge’s signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Washington, D.C. 


Printed name and litle 
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PILES 
AUG - 3 2018 
Clerk, U.S. District & Bankruptey 


Courts tor the District of Columbla 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 4:18-sc—-02583 

INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A. 

THREE ACCOUNTS STORED AT Assign. Date : 8/3/2018 

PREMISES CONTROLLED BY Description: Search & Seizure Warrant 


MICROSOFT, GOOGLE, AND APPLE | 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

le I make this affidavit in support of an application for a search warrant for 
information associated with the following: 

a. The email on i (hereafter “Target Account 1), that is 
stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with 
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be 
disclosed by Microsoft and searched by the government is described in the following paragraphs 
and in Attachments A and B. 

b. The email =o (create: “Target Account 2”), that is 
stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with 
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The 
information to be disclosed by Google and searched by the government is described in the 


following paragraphs and in Attachments C and D. 


c. The iCloud =m Q with the Apple email account 
E; (hereafter “Target Account 3”), that is stored at premises owned, 
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maintained, controlled, or operated by Apple, Inc., a business with offices located at 1 Infinite 
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by 
the government is described in the following paragraphs and in Attachment E and F. 

2. I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation 
(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and 
experience in investigating criminal and national security matters. 

3, The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4, Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain communications relevant to 
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 
(misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 
U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512 
(obstruction of justice), 18 U.S.C. § 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign 
contribution ban) (the “Subject Offenses”). 

5. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for Roger STONE'S TE (Target 


Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE’s 


= adress TR orc Account 2). On or about March 14, 2018, Chief 


Judge Howell issued a search warrant for STONE’s iCloud account (Target Account 3). This 


2 
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warrant seeks to search those accounts from the date each respective warrant was issued to the 
present. 
JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Jd. s$ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 2711(3)(A)(G). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraphs 14, 19, and 61. 

SUMMARY 

T This application seeks authority to search, from the date of search warrants 
previously issued by the Court to the present, three accounts believed to be used by Roger 
STONE: Target Account 1, which is STONE’ s Hotmail account; Target Account 2, which is 
STONE’s Gmail account; and Target Account 3, which is STONE’s iCloud account. As set 
forth herein, there is probable cause to believe that each of the Subject Accounts contains 
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with 
witnesses, and make false statements. 

8. For example, as set forth in more detail below, in recent months STONE has 
reached out to communicate with multiple witnesses he knew or had reason to believe were 


scheduled to testify before Congress about interactions with STONE during the 2016 presidential 
campaign or were scheduled to meet with the Special Counsel’s Office 


ee. After STONE learned that one witness, Randy 


CREDICO, was prepared to contradict STONE’s congressional testimony, STONE repeatedly 
3 


Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 137 of 189 


urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so 


through multiple text messages. In June 2018, STONE instructed his private investigator to 


provide him with a full background investigation on another vines: i who had 
done information technology work for STONE during the campaign on 


9. In September 2017, STONE released a statement he said he provided to Congress 
in which he denied having advance knowledge of “the source or actual content of the Wikileaks 
disclosures regarding Hillary Clinton.” He also stated publicly that when he tweeted during the 
campaign, on August 21, 2016, “it will soon the Podesta’s time in the barrel,” he was not 
referring to the hacking or publication of John Podesta’s emails, but rather. to “Podesta’s business 
dealings with Russia.” Evidence obtained in the investigation, however, shows the following: 

a. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to “Get 
to Assange” at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” Julian 
ASSANGE is the founder of WikiLeaks. On or about July 31, 2016, STONE also instructed 
CORSI to have fl onic ASSANGE. On or about August 2, 2016, CORSI 
responded to STONE that the “[w]ord is friend in embassy plans 2 more dumps. One shortly 
after I’m back. 2nd in Oct. Impact planned to be very damaging.... Time to let more than 
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC.” After receipt of 
that message, on or about August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, 
it will soon the Podesta’s time in the barrel. #CrookedHillary.” 

b. Information disclosures subsequently occurred on or about the times 
CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the 


United States (“shortly after I’m back”), Guccifer 2.0 released hacked information related to the 
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Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day 
the Washington Post published a breaking story about an Access Hollywood videotape of then- 
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked 
from the account of John Podesta. 

©; Furthermore, on the day of the Access Hollywood video disclosure, there 
were phone calls between STONE and CORSI after the Washington Post contacted STONE 
prior to publication. At approximately 11:00AM, the Washington Post received a tip regarding 
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE 
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM, 
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called 
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post 


published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks 


tweeted out its first release of emails hacked from John Podesta. 
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PROBABLE CAUSE. 


A. Background on Relevant Individuals 
i. Roger STONE 
10. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii, Jerome CORSI 
11. | Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. U.S. Intelligence Community Assessment of Russian Government-Backed Hacking 
Activity during the 2016 Presidential Election 


1%. On October 7, 2016, the U.S. Department of Homeland Security and the Office of 
the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following: 

a. The U.S. Intelligence Community (““USIC”) is confident that the Russian 
Government directed the recent compromises of emails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked emails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 


with the methods and motivations of Russian-directed efforts. These thefts and disclosures were 
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intended to interfere with the U.S. election process. Such activity is not new to Moscow—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

14. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

a. “Russian President Vladimir Putin ordered an influence campaign in 2016 
aimed at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

b. The USIC also described, at a high level, some of the techniques that the 
Russian government employed during its interference. The USIC summarized the efforts as a 
“Russian messaging strategy that blends covert intelligence operations—such as cyber activity— 
with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

A With respect to “cyber activity,” the USIC assessed that “Russia’s 
intelligence services conducted cyber operations against targets associated with the 2016 US 
presidential election, including targets associated with both major US political parties.” Further, 
“fijn July 2015, Russian intelligence gained access to Democratic National Committee (DNC) 


networks and maintained that access until at least June 2016.” The USIC attributed these cyber 
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activities to the Russian GRU, also known as the Main Intelligence Directorate: “GRU 
operations resulted in the compromise of the personal e-mail accounts of Democratic Party 
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the 
DNC.” The GRU is the foreign military intelligence agency of the Russian Ministry of Defense, 
and is Russia’s largest foreign intelligence agency. 

d. With respect to the release of stolen materials, the USIC assessed “with 
high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

é. Guccifer 2.0, who claimed to be an independent Romanian hacker, made 
multiple contradictory statements and false claims about his identity throughout the election. 

C. Additional Hacking Activity by Individuals Associated with the GRU 

15. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 campaign through at least 
November 1, 2016. 

16. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the. “snapshots” to 
those accounts. 

17. Onor about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 


emails were later posted on DCLeaks. 
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18. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

19. On or about July 13, 2018, a grand jury in this District indicted eleven GRU 
officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons 
and entities involved in the 2016 U.S. presidential election, steal documents from those 
computers, and stage releases of stolen documents in order to interfere with the election. The 
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign 
Committee (“DCCC”), and the chairman of the Clinton campaign (John Podesta). See United 
States v. Viktor Borisovich Netyksho, et al. (1:18-cr-215) (D.D.C.).' 

D. Roger STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

20. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors. The media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

21. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 


the DNC. 


1 A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for 
administering elections, including state boards of election, secretaries of state, and companies that supply software 
and other technology used to administer elections. 
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22, On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’!l see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world 
would see for themselves how the Democrats had rigged the game.” 

23. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by ASSANGE to Russia 
Today (RT) several days earlier about an upcoming “October Surprise” aimed at the Hillary 
Clinton presidential campaign. Specifically, STONE was asked: “With regard to the October 
surprise, what would be your forecast on that given what Julian Assange has intimated he’s 
going to do?” STONE responded: “Well, it could be any number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, STONE 
clarified that while he was not personally in touch with ASSANGE, he had a close friend who 
served as an intermediary. 

24. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

25. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 


2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
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Twitter account was reinstated. 

26. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

27. On August 18, 2016, Paul Manafort, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. 

28. As noted above, on August 21, 2016, using @RogerJStoneJR, STONE tweeted: 
“Trust me, it will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN 
interview that same day, STONE reiterated that because of the work of a “‘mutual acquaintance’ 
of both his and [ASSANGE], the public [could] expect to see much more from the exiled 
whistleblower in the form of strategically-dumped Clinton email batches.” He added: “Well, 
first of all, I think Julian Assange is a hero... I think he’s taking on the deep state, both 
Republican and Democrat. I believe that he is in possession of all of those emails that Huma 
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are 
like the Watergate tapes.” 

29. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

30. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #=WikiLeaks.” 

31. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 


tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
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of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

32. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

33. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

34. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 


35. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
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from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

E. STONE?’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

36. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 

Twitter account @RogerJStoneJr. Information recovered from the search of that account 
includes the following: 

a. On October 13, 2016, while WikiLeaks was in the midst of releasing the 
hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

. b. Less than an hour later, @wikileaks responded by direct message: “We 
appreciate that. However, the false claims of association are being used by the democrats to 
undermine the impact of our publications. Don’t go there if you don’t want us to correct you.” 

Cy On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 


operation leaks like a sieve. You need to figure out who your friends are.” 
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d. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

ë. In addition, @RogerJStoneJr also exchanged direct messages with 
ASSANGE. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. Ifthe US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

f. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 


this forum as experience demonstrates it is monitored. Best regards R.” 


15 


Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 149 of 189 


F. STONE’s Communications with sonr and Others Regarding 
Forthcoming Leaks 


37. As indicated above, on September 11, 2017, Chief Judge Howell issued a search 


warrant for STONE it os le (Target Account 1); on 


October 17, 2017, Chief Judge Howell issued a search warrant for STONE MM cess, 


O= QR Account 2); and on or about March 14, 2018, Chief Judge 


Howell issued a search warrant for STONE’s iCloud account (Target Account 3). In addition, 


on or about December 19, 2017, Chief Judge Howell issued a search warrant a: 


email account. Information recovered pursuant to those search warrants includes the following: 

a. On or about May 15, 2016 MY emailed CORSI: “Here is my 
flight schedule. Need to get something confirmed now... .” CORSI responded,.“I copied 
Roger Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI 
that, “May meet Manafort -guarantee nothing.” 


b. On or about May 18, 2016, CORSI emailed STONE at Target Account 1 


with the title, “Roger -- why don’t you look this over before I send go believe that 


O I did manage to see Mr. Trump for a few minutes today as we were 


waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 


was very cordial. He would look for this memo from you this afternoon.” 
c. On July 25, 2016, STONE, using Target Account 1, sent an email to 


CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
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[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

d; On or about July 31, 2016, STONE, using Target Account 1, emailed 
CORSI with the subject line, “Call me MON.” The body of the email "cad should see 
Assange| | | should find Bernie [S]anders brother who called Bill a Rapist — turn him for 
Tromp should ini —. or more proof of Bill getting kicked out.” 

ĉi; As noted above, on or about August 2, 2016 (approximately 19 days 
before STONE publicly tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE 
at Target Account 1: “Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued: “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect 
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more 
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears 
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory 
bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage 
for Foundation debacle.” Investigators believe that CORSI’s reference to a “friend in embassy 
[who] plans 2 more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 
2016. 

f. On or about August 5, 2016 an associate of STONE’s, 
emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton 
led Trump by 15 points. STONE responded, “enjoy it while u canf.] I dined with my new pal 


Julian Assange last night.” e subsequently stated to investigators that, around the 
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same time, STONE told him he had gone to London to meet nss ano fil also stated 


that in 0 told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE go OY he was joking and 


had not actually met ASSANGE.? 

g. On or about August 15, 2016, CORSI emailed STONE at Target Account 
1: “Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it’s not 
over yet. More to come than anyone realizes. Won’t really get started until after Labor Day. I’m 
in NYC this week. Jerry.” 

h. On or about August 31, 2016, CORSI emailed STONE at Target Account 
1: “Did you get the PODESTA writeup.” STONE replied “[y]es.” 

i. On or about August 31, 2016, CORSI messaged STONE at Target 
Account 3, “Podesta paid $180k to invest in Uranium One — was hired by Rosatom in Giustra 
scandal. Podesta now under FBI investigation — tied to Ukraine Yanukovych — Panama papers 
reveals Podesta hired by S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to 
Russia undermine Clinton false narrative attempting to tie Trump to Putin.” 

jf On or about September 6, 2016, CORSI emailed STONE at Target 
Account 1: “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 


k. On or about September 24, 201 emailed CORSI, “I will 


have much more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, 
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“We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to 


him about it again oy wrote back, “Awaiting secret file. Explosive... Hope you 


are well. Can’t wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me 
posted about file[.]” In a subsequent meeting with investigators im indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

k On or about October 3, 2016, an associate of STONE emailed STONE at 
Target Account 2 and asked: “Assange — what’s he got? Hope it’s good.” STONE wrote back, 
“It is. P’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will be 
out in Jan. Many scores will be settled.” The associate forwarded the email to Steve BANNON, 
who was CEO of the Campaign at the time, and wrote: “You should call Roger. See below. You 
didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry about.” The 
associate responded, “Well clearly he knows what Assange has. Pd say that’s important.” 

m. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

n. On or about October 4, 2016, CORSI messaged STONE at Target 
Account 3, “Assange made a fool of himself. Has nothing or he would have released it. Total 


BS hype.” 
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O. That same day, BANNON emailed STONE at Target Account 2, “What 
was that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are 
going to kill him and the London police are standing done [sic].” BANNON wrote back, “He 
didn’t cut deal w/ clintons???” STONE replied, “Don’t think so BUT his wye is a 
big democrat.” 

p- When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released 


38. According to a publicly available news article,’ at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood’ and NBC for reaction.” 


39. According to phone coor n at approximately 


11:27 AM, CORSI placed a call to STONE which STONE did not answer. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was- 
on/2016/10/07/3 1d74714-8ce5-1 1e6-875e-2c 1 bfe943b66_story.html 
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40. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

4]. | At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

42. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

43. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

44. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, “I expect that much 
of next dump focus, setting stage for Foundation debacle.” 

45. At approximately 627 an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target 
Account 2, forwarded MMMM message to CORSI without comment. STONE does not appear 


to have forwarded the email to any other individual. 


H. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


46. Onor about October 8, 2016, STONE, using Target Account 3, messaged 
CORSI, “Lunch postponed — have to go see T.” CORSI responded to STONE, “Ok. I 
understand.” Approximately twenty minutes later, CORSI texted, “Clintons know they will lose 
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a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs 
speech comments, attacking bad job numbers.” 

47. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
using Target Account 2, emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM, “need your BEST podesta pieces.” CORSI 
wrote back at approximately 8:54AM, “Ok. Monday. The remaining stuff on Podesta is 
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian 
translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

48. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM, 
CORSI emailed STONE at both Target Account 1 and 2 with the subject line “Podesta talking 
points.” Attached to the email was a file labeled, “ROGER STONE podesta talking points Oct 
12 2016.docx.” The “talking points” included the statement that “Podesta is at the heart of a 
Russian-government money laundering operation that benefits financially Podesta personally and 
the Clintons through the Clinton Foundation.” 

49. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via Target Account 1: “Got them and used them.” 

50. On or about Thursday, October 13, 2016, CORSI emailed STONE at Target 
Account 2: “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to CLINTON 
FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could post under my 
by-line since I am the one under attack by Podesta and now Mook.” CORSI wrote back to 


STONE, “Pll give you one more — NOBODY YET HAS THIS[:] It looks to me like 
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Sa skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] ono 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

51. On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent 
STONE an email at Target Account 2, with the subject, “ROGER STONE article RUSSIAN 
MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN 
PODESTA.” The text stated: “Roger[,] You are free to publish this under your own name.” 
That same day, STONE posted a blog post with the title, “Russian Mafia money laundering, the 
Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I have had some 
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr. 
Podesta nor I have I ever received documents or data from Wikileaks.” The post then asked, 
“Just how much money Too a controversial Russian billionaire investor with 
ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian 
regional bank owned 99.978 percent Jo o with the money transferred via Deutsche 
Bank and Trust Company Americas in New York City, with the money ending up in a private 
bank account in the Bank of America that is operated by the Clinton Foundation?” 

52: On or about October 14, 2016, CORSI sent a message to STONE at Target 
Account 3, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 


basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 
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53; On or about October 17, 2016, CORSI messaged STONE at Target Account 3, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

54. On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1 
and 2 with the subject, “Fwd: ASSANGE. ..URGENT...” CORSI wrote, “From a very trusted 
source,” and forwarded an email with the header information stripped out, showing only the 
body text. The email read, “Yes[.] I figured this. Assange is threatening Kerry, Ecuador and 
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set 
of dead man files that include Hillary. It’s what they used to call a ‘Mexican stand off].]’ Only 
hope is that if Trump speaks out to save him[.] Otherwise he’s dead anyway, once he’s dropped 
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to 
play out. He’s called Podesta’s bluff and raised him the election.” 

55. On or about October 18, 2016, CORSI messaged STONE at Target Account 3, 
“Pls call. Important.” 

56. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had “‘no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear it 
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 


57. | On or about November 8, 2016, the United States presidential election took place. 
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58. On or about November 9, 2016, CORSI messaged STONE at Target Account 3, 
“Congratulations, Roger. He could not have done it without you.” 
59. On or about November 10, 2016, CORSI messaged STONE at Target Account 3, 


“Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in London. 


Have some interesting news for you.” 
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J. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


6l. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’ s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. | thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. ... 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
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I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 


62. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 

encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange, 

you were only referring to a single fact that you had confirmed with the intermediary — 

MR. STONE: That — 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. 

63. Inthe month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. ... [M]y tweet referred to Podesta’s business dealings with Russia, and the 


expectation that it would become a news story.” 


K. STONE’s Use of Target Account 3 to Message Randy CREDICO about STONE’s 
“Back channel” 
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64. On November 19, 2017, Randy CREDICO (who, as described further below, 
STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE on Target 
Account 3, “My lawyer wants to see me today.” STONE responded, “Stonewall it. Plead the 
fifth. Anything to save the plan’........ Richard Nixon[.]” CREDICO responded, “Ha ha.” 

65. On or about November 21, 2017, CREDICO messaged STONE on Target 
Account 3, “I was told that the house committee lawyer told my lawyer that I will be getting a 
subpoena[.]” STONE wrote back, “That was the point at which your lawyers should have told 
them you would assert your Sth Amendment rights if compelled to appear.” They continued to 
message, and CREDICO wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To 
do what ? Nothing happening in DC the day before Thanksgiving — why are u busting my 
chops?” 

66. On or about November 24, 2017, STONE, using Target Account 3, texted 
CREDICO, “Assange is a journalist and a damn good one- meeting with him is perfectly legal 
and all you ever told me was he had the goods [o]n Hillary and would publish them — which he 
himself said in public b4 u told me . It’s a fucking witchunt [sic].” CREDICO replied, “I told 
you to watch his tweets. That’s what I was basing it on. I told you to watch his Tweets in 
October not before that I knew nothing about the DNC stuffl.] I just followed his tweets[.]” 
STONE responded, “U never said anything about the DNC but it was August.” CREDICO 
wrote back, “It was not August because I didn’t interview him or meet him until August 26th[.] 
That was my first communication with his secretary in London, August 26th.” STONE wrote 


back, “Not the way I remember it — oh well I guess Schiff will try to get one of us indicted for 


perjury[.]” 
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67. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on November 24, 2017, CREDICO wrote to STONE, “Forensic evidence proves that there is 
no back Channel. So now you can relax.” 

68. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

69. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that, “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ .. . Credico never said he knew or had any information as to source or 
content of the material.” 

70. On or about December 1, 2017, CREDICO messaged STONE on Target 
Account 3, stating, “I don’t know why you had to lie and say you had a back Channel now I had 
to give all of my forensic evidence to the FBI today what a headache[.]* You could have just told 
him the truth that you didn’t have a back Channel they now know that I was not in London until 
September of this year[.] You had no back-channel and you could have just told the truth . . . 
You want me to cover you for perjury now{.]” STONE responded, “What the fuck is your 
problem? Neither of us has done anything wrong or illegal. You got the best press of your life 


and you can get away with asserting for 5th Amendment rights if u don’t want talk about AND if 


* Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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you-turned over anything to the FBI you’re a fool.” CREDICO responded, “You open yourself 
up to six counts of perjury[.] But I’m sure that wasn’t sworn testimony so you’re probably 
clear[.] Council for the committee knows you never had a back Channel and if you had just told 
the truth wouldn’t have put me in this bad spot .. . you should go back . .. and amend your 
testimony and tell them the truth.” CREDICO repeated: “you need to amend your testimony 
before I testify on the 15th.” STONE replied, “If you testify you’re a fool. Because of tromp 
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I 
guarantee you you [sic] are the one who gets indicted for perjury if you’re stupid enough to 
testify[.]” 

71. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

72. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

73. | STONE and CREDICO continued to exchange messages via Target Account 3, 
and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with 
a reporter. STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” 
CREDICO messaged STONE, “I have the email from his chief of staff August 25th 2016 
responding to an email I sent to WikiLeaks website email address asking you would do my 


show[.] That was my initial contact.” 
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74. Onor about January 8, 2018, CREDICO messaged STONE on Target Account 3 
stating: “Embassy logs... + 17 other pieces of information prove that I did not have any 
conversations with Assange until September of last year.” 

T5. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE on Target Account 3: “You lied to the house Inte! 
committee ... But you’ll get off because you’re friends with Trump so don’t worry. I have all 
the forensic evidence[.] I was not a ba[ck] Channel and I have all those emails from September 
of 2016 to prove it[.]” 

76. Onor about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you start bringing up my dog, you’re crossing the line[.]”° 

77. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.° In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 


me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog- 
135911370.html 


6 https://www.motherjones.com/politics/20 1 8/05/roger-stone-to-associate-prepare-to-die/ 
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He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 


L. STONE’s Use of the Target Accounts to Communicate with Individuals Related to 
the Investigation 


78. On May 17, 2018, Chief Judge Howell issued an order for the use of pen-trap 
devices on Target Account 1 and Target Account 2. The information obtained from that order, 
along with information obtained from toll records, revealed that STONE has continued to use 
Target Account 1 and Target Account 2, and that he has used them to communicate with 


individuals related to the investigation. 


79. For example, STONE an communicated twice on May 28 and May 


29, 2018 using Target Account 1. , a former associate of STONE’s, was 
interviewed by the Special Counsel’s Office on or about May 2, 2018. Toll records show that 

a: STONE communicated multiple times on May 5, 2018, and STONE 
communicated wi o o using Target Account 1 on June 1, 2018 and June 6, 213 


moo a private investigator who had previously worked with STONE and who was hired 


by STONE to research individuals associated with this case (as described further below), 
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and 


July 12, 2018. 


80. STONE has also used Target Account 2 to communicate with individuals 


associated with this investigation. 


a. For example, between May 23, 2018 and the present, STONE and CORSI 
exchanged at least five messages using Target Account 2. In the same time period, STONE 


exchanged at least 75 emails with CREDICO using Target Account 2. 
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b. Also in this same time period, STONE mite at least 


ten times using Target Account Z| is a former employee of STONE. On May 9, 


and again on May 10, 2018, OO «205028 by phone with 


STONE. Overall, between May 23, 2018 and the present, STONE exchanged over 100 emails 


wh o using Target Account 2. In addition, between on or about June 14, 2018 and 


June 17, 2018 


and STONE exchanged five emails using Target Account 2. 


81. STONE has also used a phone number associated with Target Account 3 to 


communicate wi o o a private investigator hired by STONE. a was 


interviewed by investigators on June 7, 2018, and subsequently informed investigators that in 


June 2018, STONE instructed him to conduct a full background investigation Sooo 


a... had been employed by STONE during the Campaign as an information technology 


specialist. 


also told investigators that in June 2018, STONE instructed him to find 


an address for CREDICO that could be used to serve CREDICO with legal process. 
K investigators that his primary form of communication with STONE is by text 


message on Target Account 3. 


BACKGROUND CONCERNING EMAIL 
82. In my training and experience, I have learned the Providers provide a variety of 


on-line services, including electronic mail (“email”) to the public. The Providers allow 
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subscribers to obtain email accounts at the domain names identified in the email address 
contained in Attachment A and C. Subscribers obtain an account by registering with the 
Providers. During the registration process, the Providers ask subscribers to provide basic 
personal information. Therefore, the computers of the Providers are likely to contain stored 
electronic communications (including retrieved and unretrieved email) for their subscribers and 
information concerning subscribers and their use of services, such as account access information, 
email transaction information, and account application information. In my training and 
experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

83. In my training and experience, email Providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

84. In my training and experience, email Providers typically retain certain 
transactional information about the creation and use of each account on their systems. This 
information can include the date on which the account was created, the length of service, records 
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account 


(including whether the account is inactive or closed), the methods used to connect to the account 
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(such as logging into the account via the Providers’ website), and other log files that reflect 
usage of the account. In addition, email Providers often have records of the Internet Protocol 
address (“IP address”) used to register the account and the IP addresses associated with particular 
logins to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

85. In my training and experience, in some cases, email account users will 
communicate directly with an email service Providers about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. Email Providers 
typically retain records about such communications, including records of contacts between the 
user and the Providers’ support services, as well as records of any actions taken by the Providers 
or user as a result of the communications. In my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. 

86. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 


as date and time) may indicate who used or controlled the account at a relevant time. Further, 
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information maintained by the email Providers can show how and when the account was 
accessed or used. For example, as described below, email Providers typically log the Internet 
Protocol (IP) addresses from which users access the email account, along with the time and date 
of that access, By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time (e.g., location information integrated into an image or video sent 
via email). Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime (e.g., 
communications relating to the crime), or consciousness of guilt (e.g., deleting communications 
in an effort to conceal them from law enforcement). 

87. In my training and experience, information such as search history can help to 
show the state of mind of an individual at the time the search was made, as well as the 
individuals potential advance knowledge of events, as they search to see if the anticipated event 


has occurred. 


INFORMATION REGARDING APPLE ID AND iCLOUD’ 


t The information in this section is based on information published by Apple on its website, including, but 
not limited to, the following document and ee “U. S. Law Enforcement Legal Process Guidelines,” available 
at http://images.a s-us.pdf; “Create and start using an Apple ID,” 
available at https: PAER apple.com/en-us/HT203993; “iCloud,” available at http://www.apple.com/icloud/; “What 
does iCloud back up?,” available at https://support.apple.com/kb/PH12519; “iOS Security,” available at 
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88. Apple is a United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 


the Mac OS operating system. 


89. Apple provides a variety of services that can be accessed from Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

a. Apple provides email service to its users through email addresses at the 
domain names mac.com, me.com, and icloud.com. 

b. iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (“iMessages”) 
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to 
conduct video calls. 

C: iCloud is a file hosting, storage, and sharing service provided by Apple. 
iCloud can be utilized through numerous iCloud-connected services, and can also be used to 
store iOS device backups and data associated with third-party apps. 

d. iCloud-connected services allow users to create, store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and 


manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 


https://www.apple.com/business/docs/iOS Security _Guide.pdf, and “iCloud: How Can I Use iCloud?,” available at 
https://support.apple.com/kb/PH26502. 
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to share those images and videos with other Apple subscribers. iCloud Drive can be used to 
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable 
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers 
on all of the user’s Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers, 
Keynote, and Notes), enables iCloud to be used to create, store, and share documents, 
spreadsheets, and presentations. 1Cloud Keychain enables a user to keep website username and 
passwords, credit card information, and Wi-Fi network information synchronized across multiple 
Apple devices. 

e. Game Center, Apple’s social gaming network, allows users of Apple 
devices to play and share games with each other. 

f: Find My iPhone allows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. Find My 
Friends allows owners of Apple devices to share locations. 

g. Location Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. 

h. App Store and iTunes Store are used to purchase and download digital 
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or 
through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS. Additional digital content, including music, movies, and television shows, can be 
purchased through iTunes Store on iOS devices and on desktop and laptop computers running 


either Microsoft Windows or Mac OS. 
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90. Apple services are accessed through the use of an “Apple ID,” an account created 
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 
syncing mechanism. 

91. An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 
associated with an Apple ID by the user. 

92. Apple captures information associated with the creation and use of an Apple ID. 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers. The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgot” pages on 
Apple’s website. In addition, Apple captures the date on which the account was created, the 
length of service, records of log-in times and durations, the types of service utilized, the status of 
the account (including whether the account is inactive or closed), the methods used to connect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access 


the account, and other log files that reflect usage of the account. 
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93. Additional information is captured by Apple in connection with the use of an 
Apple ID to access certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 
invitation logs” for FaceTime calls, “query logs” for iMessage, and “mail logs” for activity over 
an Apple-provided email account. Records relating to the use of the Find My iPhone service, 
including connection logs and requests to remotely lock or erase a device, are also maintained by 
Apple. 

94. Apple also maintains information about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“ICCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, including the Media Access Control address (“MAC 
address”), the unique device identifier (“UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
captured when used to access services through icloud.com and apple.com. Apple also retains 
records related to communications between users and Apple customer service, including 
communications regarding a particular Apple device or service, and the repair history for a 


device. 
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95. Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, including: email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and 
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain). 
iCloud can also be used to store iOS device backups, which can contain a user’s photos and 
videos, iMessages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call history, contacts, calendar events, reminders, 
notes, app data and settings, Apple Watch backups, and other data. Records and data associated 
with third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an 
instant messaging service, can be configured to regularly back up a user’s instant messages on 
iCloud Drive. Some of this data is stored on Apple’s servers in an encrypted form but can 


nonetheless be decrypted by Apple. 


96. In my training and experience, evidence of who was using an Apple ID and from 
where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 


suspicion. 


INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 
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97. I anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the accounts in Attachment A, C, and 
E and particularly described in Section I of Attachment B, D, and F. Upon receipt of the 
information described in Section I of Attachments B, D, and F, government-authorized persons 
will review that information to locate the items described in Section II of Attachment B, D, and 
F. The items identified in Attachments A-F will also be screened by reviewers not on the 
prosecution team to identify and filter out privileged material. 

CONCLUSION 

98. Based on the forgoing, I request that the Court issue the proposed search warrant. 

99. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

100. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Andrew Mitchell 
Special Agent 
Federal Bureau of Investigation 
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pd 


Subscribed and sworn to before me on ae day of August, 2018. 


fee, Po 
I 
The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the email address: 


created or maintained between September 11, 2017 and present, that is stored at premises owned, 
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered 


at One Microsoft Way, Redmond, WA 98052. 
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ATTACHMENT B 
Particular Things to be Seized 


I. Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 


a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


b. All existing printouts from original storage of all of the electronic mail described above 
in Section LA. above; 


c. All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above in Section L.A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 


e. All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 


f. Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 


g. All records indicating the services available to subscribers of the electronic mail address 
described above in Section I.A.; 
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Il. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1, 
2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome Corsi, Julian Assange, 
Randy Credico, or any individual 


associated with the trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 
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i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 


48 


Case 1:19-mc-00029-CRC Document 29-13 Filed 04/28/20 Page 182 of 189 


ATTACHMENT C 


Property to be Searched 


This warrant applies to information associated with the following Google account: 


created or maintained between October 17, 2017 and the present, that is stored.at premises 
owned, maintained, controlled, or operated by Google, Inc., a business with offices located at 


1600 Amphitheatre Parkway, Mountain View, CA 94043. 
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ATTACHMENT D 
Particular Things to be Seized 


I. Files and Accounts to be produced by Google, Inc. 


To the extent that the information described in Attachment C is within the possession, 
custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment C: 


a. The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


b. All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 


ë. All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 


A All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 


f. All records or other information regarding the identification of the account 
described above in Section L.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 


g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section LA.; 


h. Google+ subscriber information, circle information, including name of 
circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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i. Google Drive files created, accessed or owned by the account; 


i YouTube subscriber information, private videos and files, private 
messages, and comments; 


k. Google+ Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 


L. Google Talk and Google Hangouts conversation logs associated with the 
account. 
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I. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment C which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome os Assange, 
Randy Credico, or any individual 
associated with the irump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 


above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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ATTACHMENT E 
Property to be Searched 


This warrant applies to information associated with the following Apple DSID: 


created or maintained between March 14, 2018 and the present, that is stored at premises owned, 
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino, 


California 95014. 
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ATACHMENT F 
Particular Things to be Seized 


I Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment E is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, files, logs, or information that have becn 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment E: 


a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 


b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMST”), and International Mobile 
Station Equipment Identities (“IMEI”); 


G; The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 


d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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e. The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 


f All activity, conncction, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 


g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 


h. All records pertaining to the types of service used; 


i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 


j. All files, keys, or other information necessary to decrypt any data produced in an 


encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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H. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


. . 


b. All records, information, documents or tangible m any way to 
communications or meetings involving Jerome Corsi, Julian Assange, 
andy Credico, or any individual 


associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 


In the Matter of the Search of 
Case: 1:18-sc-02582 


Assigned To : Howell, Beryl A. 


) 
(Briefly describe the property to be searched ) 
) 
INFORMATION ASSOCIATED WITH THREE Assign. Date : 8/3/2018 
) 


or identify the person by name and address) 
ACCOUNTS STORED AT PREMISES CONTROLLED Description: Search & Seizure Warrant 
BY MICROSOFT, GOOGLE, AND APPLE 
SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Western District of Washington 


(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before August 15, 2018 (not to exceed 14 days) 
@ in the daytime 6:00 a.m. to 10:00 p.m. O at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) © until, the facts justifying, the later specific date of 


Date and time issued: HA E Alb af 2 dot AY Joe ln Law AD” 


Judge 's signature 


City and state: Washington, DC o Hon. Beryl A. Howell, Chief U.S. District Judge 


~ Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the email address: 


created or maintained between September 11, 2017 and present, that is stored at premises owned, 
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered 


at One Microsoft Way, Redmond, WA 98052. 
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I. 


ATTACHMENT B 
Particular Things to be Seized 


Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 


a. 


The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 


All internet search data including all queries and location data; 


All transactional information of all activity of the account described above in Section I.A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 


All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 


Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 


All records indicating the services available to subscribers of the electronic mail address 
described above in Section LA.; 
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I. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1, 
2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome Corsi, Julian Assange, 
Randy Credico, or any individual 


associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 
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i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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FILED 


AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT 


for the AUG ~ 3 2018 
District of Columbia Clerk, U.S, District & Bunkrupicy 
Courts for the District of Columbia 
In the Matter of the Search of AAC es 
(Briefly describe the property to be searched } Case: 1:18-sc-02583 
or identify the person by name and address) ) Assigned To: -Howell, Be ryl A. 
INFORMATION ASSOCIATED WITH THREE ACCOUNTS j Assign. Date : 8/3/2018 
STORED AT PREMISES CONTROLLED BY MICROSOFT, j Description: s h & Sei W. 
GOOGLE, AND APPLE S p : Searc eizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property to be searched and give its location): 


See Attachment C 


located in the Northern _ District of California , there is now concealed (identify the 
person or describe the property to be seized): 
See Attachment D 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 
© contraband, fruits of crime, or other items illegally possessed; 
& property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 


18 U.S.C. §§ 1505, 1512, 1513 Obstruction of justice, Witness tampering 
18 U.S.C. §§ 1001, 1030,371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 


See Affidavit for add'l 


The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 
O Delayed notice of days (give exact ending date if more than 30 days: 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: Applicant's signature 


) is requested 


Aaron Zelinsky (ASC) Andrew Mitchell, Special Agent, FBI 
Printed name and title 


Sworn to before me and signed in my presence. 


Pai a = mee = A Z A AT 
oe: 813/24 l LBL L ORE” 


Judge’s signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Washington, D.C. 


Printed name and litle 
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ES i wes pay 
J i i. fla ad 
AUG - 3 2018 
Clerk, U.S. District & Bankruptcy 


Courts for the District of Columbla 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1 -18-sc-02583 

INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A. 

THREE ACCOUNTS STORED AT Assign. Date : 8/3/2018 

PREMISES CONTROLLED BY Description: Search & Seizure Warrant 


MICROSOFT, GOOGLE, AND APPLE | 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

he I make this affidavit in support of an application for a search warrant for 
information associated with the following: 

a. The email co nfl (hereafter “Target Account 1), that is 
stored at premises owned, maintained, controlled, or operated by Microsoft, Inc., a business with 
offices located at One Microsoft Way, Redmond, Washington, 98052. The information to be 
disclosed by Microsoft and searched by the government is described in the following paragraphs 
and in Attachments A and B. 

b. The email occount I (yercoter “Target Account 2”), that is 
stored at premises owned, maintained, controlled, or operated by Google, Inc., a business with 
offices located at 1600 Amphitheatre Parkway, Mountain View, California, 94043. The 
information to be disclosed by Google and searched by the government is described in the 


following paragraphs and in Attachments C and D. 


c. The iCloud account Oo Q with the Apple email account 
= Q “Target Account 3”), that is stored at premises owned, 
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itid. controlled, or operated by Apple, Inc., a business with offices located at 1 Infinite 
Loop, Cupertino, California 95014. The information to be disclosed by Apple and searched by 
the government is described in the following paragraphs and in Attachment E and F. 

2; I, Andrew Mitchell, am a Special Agent with the Federal Bureau of Investigation 
(FBI), and have been since 2011. As a Special Agent of the FBI, I have received training and 
experience in investigating criminal and national security matters. 

2 The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other agents and witnesses. This affidavit is intended 
to show merely that there is sufficient probable cause for the requested warrant and does not set 
forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contain communications relevant to 
18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 
(misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 
U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. §§ 1505 and 1512 
(obstruction of justice), 18 U.S.C. § 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 
U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign 
contribution ban) (the “Subject Offenses”). 

J; On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for Roger zon ë UO Target 


Account 1). On October 17, 2017, Chief Judge Howell issued a search warrant for STONE’ s 


E address, RE Target Account 2). On or about March 14, 2018, Chief 


Judge Howell issued a search warrant for STONE’s iCloud account (Target Account 3). This 


2 
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warrant seeks to search those accounts from the date each respective warrant was issued to the 
present. 
JURISDICTION 

6. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Jd. §§ 2703(a), (b)(1)(A), & (c)(1)(A). 
Specifically, the Court is “a district court of the United States (including a magistrate judge of 
such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below, 
including in paragraphs 14, 19, and 61. 

SUMMARY 

he This application seeks authority to search, from the date of search warrants 
previously issued by the Court to the present, three accounts believed to be used by Roger 
STONE: Target Account 1, which is STONE’s Hotmail account; Target Account 2, which is 
STONE’s Gmail account; and Target Account 3, which is STONE’s iCloud account. As set 
forth herein, there is probable cause to believe that each of the Subject Accounts contains 
evidence of the Subject Offenses, including ongoing efforts to obstruct justice, tamper with 
witnesses, and make false statements. 

8. For example, as set forth in more detail below, in recent months STONE has 
reached out to communicate with multiple witnesses he knew or had reason to believe were 


scheduled to testify before Congress about interactions with STONE during the 2016 presidential 
campaign or were scheduled to meet with the Special Counsel’s Office TT 


es. Aficr STONE learned that one witness, Randy 


CREDICO, was prepared to contradict STONE’s congressional testimony, STONE repeatedly . 
3 
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urged CREDICO to assert the Fifth Amendment and decline to answer questions, and did so 


through multiple text messages. In June 2018, STONE instructed his private investigator to 


provide him with a full background investigation on another witness —_ who had 
done information technology work for STONE during the amp ii 


9. In September 2017, STONE released a statement he said he provided to Congress 


in which he denied having advance knowledge of “the source or actual content of the Wikileaks 
disclosures regarding Hillary Clinton.” He also stated publicly that when he tweeted during the 
campaign, on August 21, 2016, “it will soon the Podesta’s time in the barrel,” he was not 
referring to the hacking or publication of John Podesta’s emails, but rather to “Podesta’s business 
dealings with Russia.” Evidence obtained in the investigation, however, shows the following: 

a. On or about July 25, 2016, Roger STONE emailed Jerome CORSI to “Get 
to Assange” at the Ecuadorian Embassy and “get pending WikiLeaks emails[.]” Julian 
ASSANGE is the founder of WikiLeaks. On or about July 31, 2016, STONE also instructed 
CORSI to B o contact ASSANGE. On or about August 2, 2016, CORSI 
responded to STONE that the “[w]ord is friend in embassy plans 2 more dumps. One shortly 
after I’m back. 2nd in Oct. Impact planned to be very damaging. ... Time to let more than 
Podesta to be exposed as in bed w enemy if they are not ready to drop HRC.” After receipt of 
that message, on or about August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, 
it will soon the Podesta’s time in the barrel. #CrookedHillary.” 

b. Information disclosures subsequently occurred on or about the times 
CORSI predicted: On or about August 12, 2016, the day CORSI was scheduled to return to the 


United States (“shortly after I’m back”), Guccifer 2.0 released hacked information related to the 


4 
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Democratic Congressional Campaign Committee (DCCC). On or about October 7, 2016, the day 
the Washington Post published a breaking story about an Access Hollywood videotape of then- 
candidate Trump making disparaging remarks about women, WikiLeaks released emails hacked 
from the account of John Podesta. 

G: Furthermore, on the day of the Access Hollywood video disclosure, there 
were phone calls between STONE and CORSI after the Washington Post contacted STONE 
prior to publication. At approximately 11:00AM, the Washington Post received a tip regarding 
the Access Hollywood video. Approximately one hour later, shortly before noon, STONE 
received a call from the Washington Post. Approximately ninety minutes later, before 2:00PM, 
STONE called CORSI and they spoke. Approximately forty minutes later, CORSI called 
STONE and the two spoke again at length. At approximately 4:00PM, the Washington Post 


published its story regarding the Access Hollywood tape. By approximately 4:30PM, WikiLeaks 


tweeted out its first release of emails hacked from John Podesta. 
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PROBABLE CAUSE. 


A. Background on Relevant Individuals 
i. Roger STONE 
10. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii. Jerome CORSI 
l1. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 
hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. U.S. Intelligence Community Assessment of Russian Government-Backed Hacking 
Activity during the 2016 Presidential Election 


I3, On October 7, 2016, the U.S. Department of Homeland Security and the Office of 
the Director of National Intelligence released a joint statement of an intelligence assessment of 
Russian activities and intentions during the 2016 presidential election. In the report, the USIC 
assessed the following: 

a. The U.S. Intelligence Community (“USIC”) is confident that the Russian 
Government directed the recent compromises of emails from US persons and institutions, 
including from US political organizations. The recent disclosures of alleged hacked emails on 
sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent 


with the methods and motivations of Russian-directed efforts. These thefts and disclosures were 
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intended to interfere with the U.S. election process. Such activity is not new to Moscow-—the 
Russians have used similar tactics and techniques across Europe and Eurasia, for example, to 
influence public opinion there. We believe, based on the scope and sensitivity of these efforts, 
that only Russia’s senior-most officials could have authorized these activities. 

14. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

a. “Russian President Vladimir Putin ordered an influence campaign in 2016 
aimed at the US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump.” 

b. The USIC also described, at a high level, some of the techniques that the 
Russian government employed during its interference. The USIC summarized the efforts as a 
“Russian messaging strategy that blends covert intelligence operations—such as cyber activity— 
with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

& With respect to “cyber activity,” the USIC assessed that “Russia’s 
intelligence services conducted cyber operations against targets associated with the 2016 US 
presidential election, including targets associated with both major US political parties.” Further, 
“G]n July 2015, Russian intelligence gained access to Democratic National Committee (DNC) 


networks and maintained that access until at least June 2016.” The USIC attributed these cyber 
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activities to the Russian GRU, also known as the Main Intelligence Directorate: “GRU 
operations resulted in the compromise of the personal e-mail accounts of Democratic Party 
officials and political figures. By May, the GRU had exfiltrated large volumes of data from the 
DNC.” The GRU is the foreign military intelligence agency of the Russian Ministry of Defense, 
and is Russia’s largest foreign intelligence agency. 

d. With respect to the release of stolen materials, the USIC assessed “with 
high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

e. Guccifer 2.0, who claimed to be an independent Romanian hacker, made 
multiple contradictory statements and false claims about his identity throughout the election. 

C. Additional Hacking Activity by Individuals Associated with the GRU 

15. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 campaign through at least 
November 1, 2016. 

16. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

Li. On or about September 4, 2016, individuals associated with the GRU stole the 


emails from a former White House advisor who was then advising the Clinton Campaign. These 


emails were later posted on DCLeaks. 
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18. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

19. On or about July 13, 2018, a grand jury in this District indicted eleven GRU 
officers for knowingly and intentionally conspiring to hack into the computers of U.S. persons 
and entities involved in the 2016 U.S. presidential election, steal documents from those 
computers, and stage releases of stolen documents in order to interfere with the election. The 
victims of the hacking and releases included the DNC, the Democratic Congressional Campaign 
Committee (“DCCC”), and the chairman of the Clinton campaign (John Podesta). See United 
States v. Viktor Borisovich Netyksho, et al. (1:18-cr-215) (D.D.C.).! 

D. Roger STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

20. On June 14, 2016, Crowdstrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors. The media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

-In that post, Guccifer 2.0 also began releasing hacked DNC documents. 
21; On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 


the DNC. 


' A twelfth defendant was charged with conspiring to infiltrate computers of organizations responsible for 
administering elections, including state boards of election, secretaries of state, and companies that supply software 
and other technology used to administer elections. 


10 


Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 18 of 61 


22. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you'll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world 
would see for themselves how the Democrats had rigged the game.” 

23. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by ASSANGE to Russia 
Today (RT) several days earlier about an upcoming “October Surprise” aimed at the Hillary 
Clinton presidential campaign. Specifically, STONE was asked: “With regard to the October 
surprise, what would be your forecast on that given what Julian Assange has intimated he’s 
going to do?” STONE responded: “Well, it could be any number of things. I actually have 
communicated with Assange. I believe the next tranche of his documents pertain to the Clinton 
Foundation but there’s no telling what the October surprise may be.” A few days later, STONE 
clarified that while he was not personally in touch with ASSANGE, he had a close friend who 
served as an intermediary. 

24. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

25. On August 13, 2016, Stone posted a tweet using @RogerJStoneJr calling Guccifer 


2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 2.0’s 
11 
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Twitter account was reinstated. 

26. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

Zit On August 18, 2016, Paul Manafort, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. 

28. As noted above, on August 21, 2016, using @RogerJStoneJR, STONE tweeted: 
“Trust me, it will soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN 
interview that same day, STONE reiterated that because of the work of a “‘mutual acquaintance’ 
of both his and [ASSANGE], the public [could] expect to see much more from the exiled 
whistleblower in the form of strategically-dumped Clinton email batches.” He added: “Well, 
first of all, I think Julian Assange is a hero... I think he’s taking on the deep state, both 
Republican and Democrat. I believe that he is in possession of all of those emails that Huma 
Abedin and Cheryl Mills, the Clinton aides, believe they deleted. That and a lot more. These are 
like the Watergate tapes.” 

29. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

30. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

3l; On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 


tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
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of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

32. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

33. | Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

34. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 


35. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
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from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s emai! (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

E. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

36. On August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 

Twitter account @RogerJStoneJr. Information recovered from the search of that account 
includes the following: 

a. On October 13, 2016, while WikiLeaks was in the midst of releasing the 
hacked Podesta emails, @RogerJStoneJr sent a private direct message to the Twitter account 
@wikileaks. This account is the official Twitter account of WikiLeaks and has been described as 
such by numerous news reports. The message read: “Since I was all over national TV, cable and 
print defending WikiLeaks and assange against the claim that you are Russian agents and 
debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

b. Less than an hour later, @wikileaks responded by direct message: “We 
appreciate that. However, the false claims of association are being used by the democrats to 
undermine the impact of our publications. Don’t go there if you don’t want us to correct you.” 

6. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 


operation leaks like a sieve. You need to figure out who your friends are.” 
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d. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

ê: In addition, @RogerJStoneJr also exchanged direct messages with 
ASSANGE. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

f. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 


this forum as experience demonstrates it is monitored. Best regards R.” 
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F. STONE’s Communications with stone and Others Regarding 


Forthcoming Leaks 
3T. As indicated above, on September 11, 2017, Chief Judge Howell issued a search 


warrant for STONE’ address Target Account 1); on 
g 


October 17, 2017, Chief Judge Howell issued a search warrant for STONE address, 


Saar (Target Account 2); and on or about March 14, 2018, Chief Judge 


Howell issued a search warrant for STONE’s iCloud account (Target Account 3). In addition, 


on or about December 19, 2017, Chief Judge Howell issued a search warrant : 


email account. Information recovered pursuant to those search warrants includes the following: 
a. On or about May 15, 206 emailed CORSI: “Here is my 
flight schedule. Need to get something confirmed now... .” CORSI responded, “I copied 
Roger Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
appears to have forwarded the message to STONE at Target Account 1, who replied to CORSI 


that, “May meet Manafort -guarantee nothing.” 


b. On or about May 18, 2016, CORSI emailed STONE at Target Account 1 


with the title, “Roger -- why don’t you look this over before I send Co I believe that 


CORSI wrote, 


and I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

C. On July 25, 2016, STONE, using Target Account 1, sent an email to 


CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
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[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

d. On or about July 31, 2016, STONE, using Target Account 1, emailed 
CORSI with the subject line, “Call me MON.” The body of the email read: Lr should see 
Assange[. ; | should find Bernie [S]Janders brother who called Bill a Rapist — turn him for 
Trump[. | fa Too or more proof of Bill getting kicked out.” 

€: As noted above, on or about August 2, 2016 (approximately 19 days 
before STONE publicly tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE 
at Target Account 1: “Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued: “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect 
presidential campaign to get serious starting Sept. Still in pre-season games. Time to let more 
than Podesta to be exposed as in bed w enemy if they are not ready to drop HRC. That appears 
to be the game hackers are now about. Would not hurt to start suggesting HRC old, memory 
bad, has stroke -- neither he nor she well. I expect that much of next dump focus, setting stage 
for Foundation debacle.” Investigators believe that CORSI’s reference to a “friend in embassy 


[who] plans 2 more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 


E On or about August 5, WO an associate of STONE’s, 


emailed Stone at Target Account 1. The email contained a link to a poll indicating that Clinton 


2016. 


led Trump by 15 points. STONE responded, “enjoy it while u can[.] I dined with my new pal 


Julian Assange last night.” FS stated to investigators that, around the 
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same time, STONE told him he had gone to London to meet assanck also stated 
that in 20 told STONE he would be interviewed by the FBI and would have to 


divulge the conversation about meeting ASSANGE. STONE a | he was joking and 
had not actually met ASSANGE.? 

g. On or about August 15, 2016, CORSI emailed STONE at Target Account 
1: “Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it’s not 
over yet. More to come than anyone realizes. Won’t really get started until after Labor Day. I’m 
in NYC this week. Jerry.” 

h. On or about August 31, 2016, CORSI emailed STONE at Target Account 
1: “Did you get the PODESTA writeup.” STONE replied “[y]es.” 

i. On or about August 31, 2016, CORSI messaged STONE at Target 
Account 3, “Podesta paid $180k to invest in Uranium One — was hired by Rosatom in Giustra 
scandal. Podesta now under FBI investigation — tied to Ukraine Yanukovych — Panama papers 
reveals Podesta hired by S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to 
Russia undermine Clinton false narrative attempting to tie Trump to Putin.” 


J: On or about September 6, 2016, CORSI emailed STONE at Target 


Account 1: “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 


k. On or about September 24, 2016, E CORSI, “I will 


have much more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, 
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“We have secure back channel through Roger. I saw him again in NYC last Friday and spoke to 


him about it again ody o | wrote back, “Awaiting secret file. Explosive... Hope you 


are well. Can’t wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me 
posted about file[.]” In a subsequent meeting with investigators indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

Í; On or about October 3, 2016, an associate of STONE emailed STONE at 
Target Account 2 and asked: “Assange — what’s he got? Hope it’s good.” STONE wrote back, 
“It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will be 
out in Jan. Many scores will be settled.” The associate forwarded the email to Steve BANNON, 
who was CEO of the Campaign at the time, and wrote: “You should call Roger. See below. You 
didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry about.” The 
associate responded, “Well clearly he knows what Assange has. Pd say that’s important.” 

m. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

n. On or about October 4, 2016, CORSI messaged STONE at Target 
Account 3, “Assange made a fool of himself. Has nothing or he would have released it. Total 


BS hype.” 
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O. That same day, BANNON emailed STONE at Target Account 2, “What 
was that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are 
going to kill him and the London police are standing done [sic].” BANNON wrote back, “He 
didn’t cut deal w/ clintons???” STONE replied, “Don’t think so BUT his lawyer J is a 
big democrat.” 

p. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released 


38. According to a publicly available news article,’ at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood’ and NBC for reaction.” 


39. According to phone or i at approximately 


11:27 AM, CORSI placed a call to STONE which STONE did not answer. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump-then-the-race-was- 
on/2016/10/07/3 1d74714-8ce5-11e6-875e-2c1 bfe943b66_story.html 
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40. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

41. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

42. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

43. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

44. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 
On or about August 2, 2016, CORSI emailed STONE on Target Account 1, “I expect that much 
of next dump focus, setting stage for Foundation debacle.” 

45. At approximately on an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using Target 
Account 2, forwarded a message to CORSI without comment. STONE does not appear 


to have forwarded the email to any other individual. 


H. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


46. On or about October 8, 2016, STONE, using Target Account 3, messaged 
CORSI, “Lunch postponed — have to go see T.” CORSI responded to STONE, “Ok. I 
understand.” Approximately twenty minutes later, CORSI texted, “Clintons know they will lose 
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a week of Paula Jones media with T attacking Foundation, using Wikileaks Goldman Sachs 
speech comments, attacking bad job numbers.” 

47. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
using Target Account 2, emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM, “need your BEST podesta pieces.” CORSI 
wrote back at approximately 8:54AM, “Ok. Monday. The remaining stuff on Podesta is 
complicated. Two articles in length. I can give you in raw form the stuff I got in Russian 
translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

48. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails, as noted above. At approximately 3:25PM, 
CORSI emailed STONE at both Target Account 1 and 2 with the subject line “Podesta talking 
points.” Attached to the email was a file labeled, “ROGER STONE podesta talking points Oct 
12 2016.docx.” The “talking points” included the statement that “Podesta is at the heart of a 
Russian-government money laundering operation that benefits financially Podesta personally and 
the Clintons through the Clinton Foundation.” 

49. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via Target Account 1: “Got them and used them.” 

50. On or about Thursday, October 13, 2016, CORSI emailed STONE at Target 
Account 2: “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to CLINTON 
FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could post under my 
by-line since I am the one under attack by Podesta and now Mook.” CORSI wrote back to 


STONE, “I'll give you one more — NOBODY YET HAS THIS[:] It looks to me like 
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aa skimmed maybe billions off Skolkovo — Skolkovo kept their money with 

Metcombank].] The Russians launched a criminal investigation[.] [web link] Once 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

Sh: On or about Thursday, October 13, 2016, at approximately 6:30PM, CORSI sent 
STONE an email at Target Account 2, with the subject, “ROGER STONE article RUSSIAN 
MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and JOHN 
PODESTA.” The text stated: “Roger[,] You are free to publish this under your own name.” 
That same day, STONE posted a blog post with the title, “Russian Mafia money laundering, the 
Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I have had some 
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr. 
Podesta nor I have I ever received documents or data from Wikileaks.” The post then asked, 
“Just how much money 7 6 a controversial Russian billionaire investor with 
ties to the Vladimir Putin and the Russian government, launder through Metcombank, a Russian 
regional bank owned 99.978 percent i with the money transferred via Deutsche 
Bank and Trust Company Americas in New York City, with the money ending up in a private 
bank account in the Bank of America that is operated by the Clinton Foundation?” 

52; On or about October 14, 2016, CORSI sent a message to STONE at Target 
Account 3, “Pm in NYC. Thinking about writing piece attacking Leer and other women. It’s 


basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 
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53. On or about October 17, 2016, CORSI messaged STONE at Target Account 3, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 

54. On or about October 17, 2016, CORSI emailed STONE at Target Accounts 1 
and 2 with the subject, “Fwd: ASSANGE...URGENT...” CORSI wrote, “From a very trusted 
source,” and forwarded an email with the header information stripped out, showing only the 
body text. The email read, “Yes[.] I figured this. Assange is threatening Kerry, Ecuador and 
U.K. He will drop the goods on them if they move to extradite him. My guess is that he has a set 
of dead man files that include Hillary. It’s what they used to call a ‘Mexican stand off].]’ Only 
hope is that if Trump speaks out to save him[.] Otherwise he’s dead anyway, once he’s dropped 
what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange has to 
play out. He’s called Podesta’s bluff and raised him the election.” 

SS On or about October 18, 2016, CORSI messaged STONE at Target Account 3, 
“PIs call. Important.” 

56. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear it 
from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 


57. On or about November 8, 2016, the United States presidential election took place. 
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58. On or about November 9, 2016, CORSI messaged STONE at Target Account 3, 
“Congratulations, Roger. He could not have done it without you.” 
39: On or about November 10, 2016, CORSI messaged STONE at Target Account 3, 


“Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in London. 


Have some interesting news for you.” 
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J. STONE?’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


61. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. . . . 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
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I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 


62. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 

encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange, 


you were only referring to a single fact that you had confirmed with the intermediary — 
MR. STONE: That — 


Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. 

63. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. ... [M]y tweet referred to Podesta’s business dealings with Russia, and the 


expectation that it would become a news story.” 


K. STONE’s Use of Target Account 3 to Message Randy CREDICO about STONE’s 
“Back channel” 
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64, On November 19, 2017, Randy CREDICO (who, as described further below, 
STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE on Target 
Account 3, “My lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the 
fifth. Anything to save the plan’........Richard Nixon[.]” CREDICO responded, “Ha ha.” 

65. On or about November 21, 2017, CREDICO messaged STONE on Target 
Account 3, “I was told that the house committee lawyer told my lawyer that I will be getting a 
subpoena[.]” STONE wrote back, “That was the point at which your lawyers should have told 
them you would assert your 5th Amendment rights if compelled to appear.” They continued to 
message, and CREDICO wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To 
do what ? Nothing happening in DC the day before Thanksgiving — why are u busting my 
chops?” 

66. On or about November 24, 2017, STONE, using Target Account 3, texted 
CREDICO, “Assange is a journalist and a damn good one- meeting with him is perfectly legal 
and all you ever told me was he had the goods [o]n Hillary and would publish them — which he 
himself said in public b4 u told me . It’s a fucking witchunt [sic].” CREDICO replied, “I told 
you to watch his tweets. That’s what I was basing it on. I told you to watch his Tweets in 
October not before that I knew nothing about the DNC stuff].] I just followed his tweets[.]” 
STONE responded, “U never said anything about the DNC but it was August.” CREDICO 
wrote back, “It was not August because I didn’t interview him or meet him until August 26th[.] 
That was my first communication with his secretary in London, August 26th.” STONE wrote 


back, “Not the way I remember it — oh well I guess Schiff will try to get one of us indicted for 


perjury[.]” 
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67. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on November 24, 2017, CREDICO wrote to STONE, “Forensic evidence proves that there is 
no back Channel. So now you can relax.” 

68. Onor about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

69. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that, “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton whith are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 
content of the material.” 

70. On or about December 1, 2017, CREDICO messaged STONE on Target 
Account 3, stating, “I don’t know why you had to lie and say you had a back Channel now I had 
to give all of my forensic evidence to the FBI today what'a headache[.]* You could have just told 
him the truth that you didn’t have a back Channel they now know that I was not in London until 
September of this year[.] You had no back-channel and you could have just told the truth... 
You want me to cover you for perjury now[.]” STONE responded, “What the fuck is your 
problem? Neither of us has done anything wrong or illegal. You got the best press of your life 


and you can get away with asserting for Sth Amendment rights if u don’t want talk about AND if 


4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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you turned over anything to the FBI you’re a fool.” CREDICO responded, “You open yourself 
up to six counts of perjury[.] But I’m sure that wasn’t sworn testimony so you’re probably 
clear[.] Council for the committee knows you never had a back Channel and if you had just told 
the truth wouldn’t have put me in this bad spot .. . you should go back ... and amend your 
testimony and tell them the truth.” CREDICO repeated: “you need to amend your testimony 
before I testify on the 15th.” STONE replied, “If you testify you’re a fool. Because of tromp 
[sic] I could never get away with a certain [sic] my Fifth Amendment rights but you can. I 
guarantee you you [sic] are the one who gets indicted for perjury if you’re stupid enough to 
testify[.]” 

Fi STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

72. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

73. STONE and CREDICO continued to exchange messages via Target Account 3, 
and on or about January 6, 2018, CREDICO indicated to STONE that he was having dinner with 
a reporter. STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardonf.]” 
CREDICO messaged STONE, “I have the email from his chief of staff August 25th 2016 
responding to an email I sent to WikiLeaks website email address asking you would do my 


show[.] That was my initial contact.” 
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74, On or about January 8, 2018, CREDICO messaged STONE on Target Account 3 
stating: “Embassy logs... + 17 other pieces of information prove that I did not have any 
conversations with Assange until September of last year.” 

75. | CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE on Target Account 3: “You lied to the house Intel 
committee . . . But you’ll get off because you’ re friends with Trump so don’t worry. I have all 
the forensic evidence[.] I was not a ba[ck] Channel and I have all those emails from September 
of 2016 to prove it[.]” 

76. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you start bringing up my dog, you’re crossing the line[.]” 

77. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency. In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 


me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 


> https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone-threatened-dog- 
135911370.html 


6 https://www.motherjones.com/politics/20 18/05/roger-stone-to-associate-prepare-to-die/ 
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He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 


L. STONE’s Use of the Target Accounts to Communicate with Individuals Related to 
the Investigation 


78. On May 17, 2018, Chief Judge Howell issued an order for the use of pen-trap 
devices on Target Account 1 and Target Account 2. The information obtained from that order, 
along with information obtained from toll records, revealed that STONE has continued to use 
Target Account 1 and Target Account 2, and that he has used them to communicate with 
individuals related to the investigation. 

79. For example, STONE and communicated twice on May 28 and May 
29, 2018 using Target Account 1. , a former associate of STONE’s, was 
interviewed by the Special Counsel’s Office on or about May 2, 2018. Toll records show that 

ca and STONE communicated multiple times on May 5, 2018, and STONE 
communicated wi using Target Account 1 on June 1, 2018 and June 6, 2015 


fit a private investigator who had previously worked with STONE and who was hired 


by STONE to research individuals associated with this case (as described further below), 
communicated with STONE on Target Account 1 at least four times between May 27, 2018 and 
July 12, 2018. 
80. STONE has also used Target Account 2 to communicate with individuals 
associated with this investigation. 
a. For example, between May 23, 2018 and the present, STONE and CORSI 
exchanged at least five messages using Target Account 2. In the same time period, STONE 


exchanged at least 75 emails with CREDICO using Target Account 2. 
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b. Also in this same time period, STONE emailed — at least 


ten times using Target Account 7 | is a former employee of STONE. On May 9, 


2018, FBI agents Due and 


and again on May 10, 2018 


That day, 


communicated by phone with 
STONE. Overall, between May 23, 2018 and the present, STONE exchanged over 100 emails 


i using Target Account 2. In addition, between on or about June 14, 2018 and 


and STONE exchanged five emails using Target Account 2 


June 17, 2018 


81. STONE has also used a phone number associated with Target Account 3 to 


communicate «i o | a private investigator hired by sonr was 


interviewed by investigators on June 7, 2018, and subsequently informed investigators that in 


June 2018, STONE instructed him to conduct a full background investigation 7 


| who had been employed by STONE during the Campaign as an information technology 


also told investigators that in June 2018, STONE instructed him to find 


an address for CREDICO that could be used to serve CREDICO with legal process. 


o= Q investigators that his primary form of communication with STONE is by text 


message on Target Account 3. 


BACKGROUND CONCERNING EMAIL 
82. In my training and experience, I have learned the Providers provide a variety of 


on-line services, including electronic mail (“email”) to the public. The Providers allow 
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subscribers to obtain email accounts at the domain names identified in the email address 
contained in Attachment A and C. Subscribers obtain an account by registering with the 
Providers. During the registration process, the Providers ask subscribers to provide basic 
personal information. Therefore, the computers of the Providers are likely to contain stored 
electronic communications (including retrieved and unretrieved email) for their subscribers and 
information concerning subscribers and their use of services, such as account access information, 
email transaction information, and account application information. In my training and 
experience, such information may constitute evidence of the crimes under investigation because 
the information can be used to identify the account’s user or users. 

83. In my training and experience, email Providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and 
other identifiers, alternative email addresses, and, for paying subscribers, means and source of 
payment (including any credit or bank account number). In my training and experience, such 
information may constitute evidence of the crimes under investigation because the information 
can be used to identify the account’s user or users. Based on my training and my experience, I 
know that, even if subscribers insert false information to conceal their identity, this information 
often provides clues to their identity, location, or illicit activities. 

84. In my training and experience, email Providers typically retain certain 
transactional information about the creation and use of each account on their systems. This 
information can include the date on which the account was created, the length of service, records 
of log-in (i.e., session) times and durations, the types of service utilized, the status of the account 


(including whether the account is inactive or closed), the methods used to connect to the account 


35 


Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 43 of 61 


(such as logging into the account via the Providers’ website), and other log files that reflect 
usage of the account. In addition, email Providers often have records of the Internet Protocol 
address (“IP address”) used to register the account and the IP addresses associated with particular 
logins to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

85. In my training and experience, in some cases, email account users will 
communicate directly with an email service Providers about issues relating to the account, such 
as technical problems, billing inquiries, or complaints from other users. Email Providers 
typically retain records about such communications, including records of contacts between the 
user and the Providers’ support services, as well as records of any actions taken by the Providers 
or user as a result of the communications. In my training and experience, such information may 
constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. 

86. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 


as date and time) may indicate who used or controlled the account at a relevant time. Further, 
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information maintained by the email Providers can show how and when the account was 
accessed or used. For example, as described below, email Providers typically log the Internet 
Protocol (IP) addresses from which users access the email account, along with the time and date 
of that access. By determining the physical location associated with the logged IP addresses, 
investigators can understand the chronological and geographic context of the email account 
access and use relating to the crime under investigation. This geographic and timeline 
information may tend to either inculpate or exculpate the account owner. Additionally, 
information stored at the user’s account may further indicate the geographic location of the 
account user at a particular time (e.g., location information integrated into an image or video sent 
via email). Last, stored electronic data may provide relevant insight into the email account 
owner’s state of mind as it relates to the offense under investigation. For example, information in 
the email account may indicate the owner’s motive and intent to commit a crime (e.g., 
communications relating to the crime), or consciousness of guilt (e.g., deleting communications 
in an effort to conceal them from law enforcement). 

87. In my training and experience, information such as search history can help to 
show the state of mind of an individual at the time the search was made, as well as the 
individuals potential advance knowledge of events, as they search to see if the anticipated event 


has occurred. 


INFORMATION REGARDING APPLE ID AND iCLOUD’ 


z The information in this section is based on information published by Apple on its website, including, but 
not limited to, the following document and webpages: “U.S. Law Enforcement Legal Process Guidelines,” available 
at http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf; “Create and start using an Apple ID,” 
available at https://support.apple.com/en-us/HT203993; “iCloud,” available at http://www.apple.com/icloud/; “What 
does iCloud back up?,” available at https://support.apple.com/kb/PH125 19; “iOS Security,” available at 

37 


Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 45 of 61 


88. Apple is a United States company that produces the iPhone, iPad, and iPod 
Touch, all of which use the iOS operating system, and desktop and laptop computers based on 


the Mac OS operating system. 


89. Apple provides a variety of services that can be accessed from Apple devices or, 
in some cases, other devices via web browsers or mobile and desktop applications (“apps”). As 
described in further detail below, the services include email, instant messaging, and file storage: 

a. Apple provides email service to its users through email addresses at the 
domain names mac.com, me.com, and icloud.com. 

b. iMessage and FaceTime allow users of Apple devices to communicate in 
real-time. iMessage enables users of Apple devices to exchange instant messages (“iMessages’’) 
containing text, photos, videos, locations, and contacts, while FaceTime enables those users to 
conduct video calls. 

% iCloud is a file hosting, storage, and sharing service provided by Apple. 
iCloud can be utilized through numerous iCloud-connected services, and can also be used to 
store iOS device backups and data associated with third-party apps. 

d. iCloud-connected services allow users to create, store, access, share, and 
synchronize data on Apple devices or via icloud.com on any Internet-connected device. For 
example, iCloud Mail enables a user to access Apple-provided email accounts on multiple Apple 
devices and on icloud.com. iCloud Photo Library and My Photo Stream can be used to store and 


manage images and videos taken from Apple devices, and iCloud Photo Sharing allows the user 


hitps://www.apple.com/business/docs/iOS_ Security Guide.pdf, and “iCloud: How Can I Use iCloud?,” available at 
https://support.apple.com/kb/PH26502. 
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to share those images and videos with other Apple subscribers. iCloud Drive can be used to 
store presentations, spreadsheets, and other documents. iCloud Tabs and bookmarks enable 
iCloud to be used to synchronize bookmarks and webpages opened in the Safari web browsers 
on all of the user’s Apple devices. iWork Apps, a suite of productivity apps (Pages, Numbers, 
Keynote, and Notes), enables iCloud to be used to create, store, and share documents, 
spreadsheets, and presentations. iCloud Keychain enables a user to keep website username and 
passwords, credit card information, and Wi-Fi network information synchronized across multiple 
Apple devices. 

& Game Center, Apple’s social gaming network, allows users of Apple 
devices to play and share games with each other. 

f Find My iPhone allows owners of Apple devices to remotely identify and 
track the location of, display a message on, and wipe the contents of those devices. Find My 
Friends allows owners of Apple devices to share locations. 

g. Location Services allows apps and websites to use information from 
cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a 
user’s approximate location. 

h. App Store and iTunes Store are used to purchase and download digital 
content. iOS apps can be purchased and downloaded through App Store on iOS devices, or 
through iTunes Store on desktop and laptop computers running either Microsoft Windows or 
Mac OS. Additional digital content, including music, movies, and television shows, can be 
purchased through iTunes Store on iOS devices and on desktop and laptop computers running 


either Microsoft Windows or Mac OS. 
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90. Apple services are accessed through the use of an “Apple ID,” an account created 
during the setup of an Apple device or through the iTunes or iCloud services. A single Apple ID 
can be linked to multiple Apple services and devices, serving as a central authentication and 
syncing mechanism. 

91. | An Apple ID takes the form of the full email address submitted by the user to 
create the account; it can later be changed. Users can submit an Apple-provided email address 
(often ending in @icloud.com, @me.com, or @mac.com) or an email address associated with a 
third-party email provider (such as Gmail, Yahoo, or Hotmail). The Apple ID can be used to 
access most Apple services (including iCloud, iMessage, and FaceTime) only after the user 
accesses and responds to a “verification email” sent by Apple to that “primary” email address. 
Additional email addresses (“alternate,” “rescue,” and “notification” email addresses) can also be 
associated with an Apple ID by the user. 

92. Apple captures information associated with the creation and use of an Apple ID. 
During the creation of an Apple ID, the user must provide basic personal information including 
the user’s full name, physical address, and telephone numbers. The user may also provide means 
of payment for products offered by Apple. The subscriber information and password associated 
with an Apple ID can be changed by the user through the “My Apple ID” and “iForgot” pages on 
Apple’s website. In addition, Apple captures the date on which the account was created, the 
length of service, records of log-in times and durations, the types of service utilized, the status of 
the account (including whether the account is inactive or closed), the methods used to connect to 
and utilize the account, the Internet Protocol address (“IP address”) used to register and access 


the account, and other log files that reflect usage of the account. 
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93. Additional information is captured by Apple in connection with the use of an 
Apple ID to access certain services. For example, Apple maintains connection logs with IP 
addresses that reflect a user’s sign-on activity for Apple services such as iTunes Store and App 
Store, iCloud, Game Center, and the My Apple ID and iForgot pages on Apple’s website. Apple 
also maintains records reflecting a user’s app purchases from App Store and iTunes Store, “call 
invitation logs” for FaceTime calls, “query logs” for iMessage, and “mail logs” for activity over 
an Apple-provided email account. Records relating to the use of the Find My iPhone service, 
including connection logs and requests to remotely lock or erase a device, are also maintained by 
Apple. 

94. Apple also maintains information about the devices associated with an Apple ID. 
When a user activates or upgrades an iOS device, Apple captures and retains the user’s IP 
address and identifiers such as the Integrated Circuit Card ID number (“ICCID”), which is the 
serial number of the device’s SIM card. Similarly, the telephone number of a user’s iPhone is 
linked to an Apple ID when the user signs in to FaceTime or iMessage. Apple also may 
maintain records of other device identifiers, including the Media Access Control address (“MAC 
address”), the unique device identifier (““UDID”), and the serial number. In addition, 
information about a user’s computer is captured when iTunes is used on that computer to play 
content associated with an Apple ID, and information about a user’s web browser may be 
captured when used to access services through icloud.com and apple.com. Apple also retains 
records related to communications between users and Apple customer service, including 
communications regarding a particular Apple device or service, and the repair history for a 


device. 
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95. Apple provides users with five gigabytes of free electronic space on iCloud, and 
users can purchase additional storage space. That storage space, located on servers controlled by 
Apple, may contain data associated with the use of iCloud-connected services, including: email 
(iCloud Mail); images and videos (iCloud Photo Library, My Photo Stream, and iCloud Photo 
Sharing); documents, spreadsheets, presentations, and other files (iWork and iCloud Drive); and 
web browser settings and Wi-Fi network information (iCloud Tabs and iCloud Keychain). 
iCloud can also be used to store iOS device backups, which can contain a user’s photos and 
videos, iMessages, Short Message Service (“SMS”) and Multimedia Messaging Service 
(“MMS”) messages, voicemail messages, call history, contacts, calendar events, reminders, 
notes, app data and settings, Apple Watch backups, and other data. Records and data associated 
sail third-party apps may also be stored on iCloud; for example, the iOS app for WhatsApp, an 
instant messaging service, can be configured to regularly back up a user’s instant messages on 
iCloud Drive. Some of this data is stored on Apple’s servers in an encrypted form but can 


nonetheless be decrypted by Apple. 


96. In my training and experience, evidence of who was using an Apple ID and from 
where, and evidence related to criminal activity of the kind described above, may be found in the 
files and records described above. This evidence may establish the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 


suspicion. 


INFORMATION TO BE SEARCHED AND THINGS TO BE SEIZED 
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97. _ | anticipate executing this warrant under the Electronic Communications Privacy 
Act, in particular 18 U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A), by using the warrant 
to require Google to disclose to the government copies of the records and other information 
(including the content of communications) associated with the accounts in Attachment A, C, and 
E and particularly described in Section I of Attachment B, D, and F. Upon receipt of the 
information described in Section J of Attachments B, D, and F, government-authorized persons 
will review that information to locate the items described in Section II of Attachment B, D, and 
F. The items identified in Attachments A-F will also be screened by reviewers not on the 
prosecution team to identify and filter out privileged material. 

CONCLUSION 

98. Based on the forgoing, I request that the Court issue the proposed search warrant. 

99. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

100. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Andrew Mitchell 
Special Agent 
Federal Bureau of Investigation 


43 


Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 


Af 
ZEA 


Subscribed and sworn to before me on this ae day of August, 2018. 


f ff Af 
a al iA 7 A 
The Honorable Beryl A. Howell 


Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the email address: 


created or maintained between September 11, 2017 and present, that is stored at premises owned, 
maintained, controlled, or operated by Microsoft Corp., d/b/a Hotmail, a company headquartered 


at One Microsoft Way, Redmond, WA 98052. 
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ATTACHMENT B 
Particular Things to be Seized 


Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Provider including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to the Provider or have been 
preserved pursuant to a preservation request under 18 U.S.C. § 2703(f), the Provider is required 
to disclose the following information to the government for each account or identifier listed in 
Attachment A: 


a. 


The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


All existing printouts from original storage of all of the electronic mail described above 
in Section I.A. above; 


All internet search data including all queries and location data; 


All transactional information of all activity of the account described above in Section I.A, 
including log files, dates, times, methods of connecting, ports, dial ups, and/or locations; 


All records or other information stored by an individual using the account, including 
address books, contact and buddy lists, calendar data, pictures, and files; 


Records or other information regarding the identification of the account described above 
in Section I.A, to include application, full name, physical address, telephone numbers and 
other identifiers, records of session times and durations, log-in IP addresses associated 
with session times and dates, account status, alternative e-mail addresses provided during 
registration, all screen names associated with subscribers and/or accounts, all account 
names associated with the subscriber, 


All records indicating the services available to subscribers of the electronic mail address 
described above in Section LA.; 
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Il. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban) from June 1, 
2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, i | Julian Assange, 
Randy Credico, or any individual 
aign, 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence ofthe times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 
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ATTACHMENT D 
Particular Things to be Seized 


Files and Accounts to be produced by Google, Inc. 


To the extent that the information described in Attachment C is within the possession, 


custody, or control of Google, Inc. including any messages, records, files, logs, images, videos, 
or information that have been deleted but are still available to Google or have been preserved 
pursuant to a preservation request under 18 U.S.C. § 2703(f), Google is required to disclose the 
following information to the government for each account or identifier listed in Attachment C: 


a. 


The contents of all e-mails, attachments and chat messages stored in the account, 
including copies of e-mails sent to and from the account, draft e-mails, the source and 
destination e-mails sent addresses associated with each e-mail, the date and time at which 
each e-mail was sent, and the size and length of each e-mail; 


b. All existing printouts from original storage of all of the electronic mail 
described above in Section I.A. above; 


c. All internet search data including all queries and location data; 


d. All transactional information of all activity of the account described above 
in Section I.A, including log files, dates, times, methods of connecting, ports, dial ups, 
and/or locations; 


ë; All records or other information stored by an individual using the account, 
including address books, contact and buddy lists, calendar data, pictures, and files; 


f. All records or other information regarding the identification of the account 
described above in Section I.A, to include application, full name, physical address, 
telephone numbers and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, the 
IP address used to register the account, log-in IP addresses associated with session times 
and dates, account status, alternative e-mail addresses provided during registration, all 
screen names associated with subscribers and/or accounts, all account names associated 
with the subscriber, methods of connecting, log files, means and source of payment 
(including any credit or bank account number), and detailed billing records; 


g. All records indicating the services available to subscribers of the 
electronic mail address described above in Section LA.; 


h. Google+ subscriber information, circle information, including name of 


circle and members, contents of posts, comments, and photos, to include date and 
timestamp; 
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i. Google Drive files created, accessed or owned by thè account; . 


jk YouTube subscriber information, private videos and files, private 
messages, and comments; 


k. Google+ Photos contents to include all images, videos and other files, and 
associated upload/download date and timestamp; 


L. Google Talk and Google Hangouts conversation logs associated with the 
account. 
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I. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment C which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome Corsi, Julian Assange, 


es | 22 Credico, or any individual 


associated with the Trump Campaign; 


c. All images, messages, communications, calendar entries, search terms, “address book” 
entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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ATTACHMENT E 
Property to be Searched 


This warrant applies to information associated with the following Apple DSID: 


created or maintained between March 14, 2018 and the present, that is stored at premises owned, 
maintained, controlled, or operated by Apple, Inc., located at One Apple Park Way, Cupertino, 


California 95014. 


33 


Case 1:19-mc-00029-CRC Document 29-14 Filed 04/28/20 Page 59 of 61 


ATACHMENT F 
Particular Things to be Seized 


I. Files and Accounts to be produced by the Provider: 


To the extent that the information described in Attachment E is within the possession, 
custody, or control of Apple, regardless of whether such information is located within or outside 
of the United States, including any messages, records, files, logs, or information that have been 
deleted but are still available to Apple, or have been preserved pursuant to a request made under 
18 U.S.C. § 2703(f), Apple is required to disclose the following information to the government, 
in unencrypted form whenever available, for each account or identifier listed in Attachment E: 


a. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers, email addresses (including primary, 
alternate, rescue, and notification email addresses, and verification information for each email 
address), the date on which the account was created, the length of service, the IP address used to 
register the account, account status, associated devices, methods of connecting, and means and 
source of payment (including any credit or bank account numbers); 


b. All records or other information regarding the devices associated with, or used in 
connection with, the account (including all current and past trusted or authorized iOS devices 
and computers, and any devices used to access Apple services), including serial numbers, Unique 
Device Identifiers (“UDID”), Advertising Identifiers (“IDFA”), Global Unique Identifiers 
(“GUID”), Media Access Control (“MAC”) addresses, Integrated Circuit Card ID numbers 
(“ICCID”), Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifiers (““MEID”), Mobile Identification Numbers (“MIN”), Subscriber 
Identity Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Numbers 
(“MSISDN”), International Mobile Subscriber Identities (“IMST”), and International Mobile 
Station Equipment Identities (“IMEI”); 


c. The contents of all emails associated with the account, including stored or 
preserved copies of emails sent to and from the account (including all draft emails and deleted 
emails), the source and destination addresses associated with each email, the date and time at 
which each email was sent, the size and length of each email, and the true and accurate header 
information including the actual IP addresses of the sender and the recipient of the emails, and 
all attachments; 


d. The contents of all instant messages associated with the account, including stored 
or preserved copies of instant messages (including iMessages, SMS messages, and MMS 
messages) sent to and from the account (including all draft and deleted messages), the source and 
destination account or phone number associated with each instant message, the date and time at 
which each instant message was sent, the size and length of each instant message, the actual IP 
addresses of the sender and the recipient of each instant message, and the media, if any, attached 
to each instant message; 
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Ge The contents of all files and other records stored on iCloud, including all iOS 
device backups, all Apple and third-party app data, all files and other records related to iCloud 
Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork 
(including Pages, Numbers, Keynote, and Notes), iCloud Tabs and bookmarks, and iCloud 
Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, 
images, videos, voicemails, device settings, and bookmarks; 


f. . All activity, connection, and transactional logs for the account (with associated IP 
addresses including source port numbers), including FaceTime call invitation logs, messaging 
and query logs (including iMessage, SMS, and MMS messages), mail logs, iCloud logs, iTunes 
Store and App Store logs (including purchases, downloads, and updates of Apple and third-party 
apps), My Apple ID and iForgot logs, sign-on logs for all Apple services, Game Center logs, 
Find My iPhone and Find My Friends logs, logs associated with web-based access of Apple 
services (including all associated identifiers), and logs associated with iOS device purchase, 
activation, and upgrades; 


g. All records and information regarding locations where the account or devices 
associated with the account were accessed, including all data stored in connection with Location 
Services, Find My iPhone, Find My Friends, and Apple Maps; 


h. All records pertaining to the types of service used; 


i. All records pertaining to communications between Apple and any person 
regarding the account, including contacts with support services and records of actions taken; and 


j- _ All files, keys, or other information necessary to decrypt any data produced in an 
encrypted form, when available to Apple (including, but not limited to, the keybag.txt and 
fileinfolist.txt files). 
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II. Information to be Seized by Law Enforcement Personnel 


Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contribution ban), from June 
1, 2015 to present, including: 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications with 
persons or entities associated with WikiLeaks, including but not limited to Julian Assange, or 
communications regarding disinformation, denial, dissembling or other obfuscation about 
knowledge of, or access to hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome <i aa Julian Assange, 
associated with the Trump Campaign; 
c. All images, messages, communications, calendar entries, search terms, “address book” 


entries and contacts, including any and all preparatory steps taken in furtherance of the 
above-listed offenses; 


d. Communication, information, documentation and records relating to who created, used, or 
communicated with the account or identifier concerning the messages identified above, 
including records about their identities and whereabouts; 


e. Evidence of the times the account was used; 


f. All images, messages and communications regarding wiping software, encryption or 
other methods to avoid detection by law enforcement; 


g. Passwords and encryption keys, and other access information that may be necessary to 
access the account and other associated accounts; 


h. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 


i. All existing printouts from original storage which concern the categories identified in 
subsection II.a 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 


District of Columbia 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH ONE ACCOUNT 
STORED AT PREMISES 
CONTROLLED BY GOOGLE 


SEARCH AND SEIZURE WARRANT 


Case: 1:18-sc-02595 

Assigned To : Howell, Beryl A. 

Assign. Date : 8/8/2018 

Description: Search & Seizure Warrant 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California _ 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before August 21, 2018 (not to exceed 14 days) 
M in the daytime 6:00 a.m. to 10:00 p.m. O at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) O until, the facts justifying, the later specific date of i 


Date and time issued: Se. E, A 4 20M O VALAA 


Judge's signature 


Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Jowell 
Printed name and title 
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AO 93 (Rev, | 1/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Google accounts, which 


are stored at premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a 


company headquartered in Mountain View, California: 
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ATTACHMENT B 


I. Information to be disclosed by Google 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 


information that have been deleted but are still available to Google, or have been preserved 


pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 


information to the government for each account listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

The types of service utilized; 

All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 
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ë, All records pertaining to communications between the Provider and any person 


regarding the account, including contacts with support services and records of 


actions taken; 
f. All subscriber “change history” associated with the account; 
g. All search history and web history associated with the account; 
h. All location and maps information associated with the account; 
j All Google Analytics information associated with the account (including all 


properties and UA codes associated with the account, and, for each of these 


proprieties and UA codes, all usernames and email accounts associated with them); 


j All Google Developers Console information associated with the account; 
k. All Minutemaid information associated with the account; 

L. All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; 


q. All Web & App Activity associated with the account; 


i All Google Drive information associated with the account; 
s. All Google+ information associated with the account; 
t. All device information associated with the account, including all instrument or 


telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 


Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”’), or 
International Mobile Equipment Identities (“IMEI’’)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 

linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 

abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 

U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 

access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 

conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2015 to the present, including: 


sÅ- 
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All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi,  — Te 


individual associated with the Trump Campaign; 

Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 


ie 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

J: Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 


in subsection Il.a. 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT F I LE D 
for the AUG =B 2018 


District of Columbia Clark, U.S. District d 
ctan 
In the Matter of the Search of Bankruptcy Courte=— 
n tne Matter o e searcn o es ee 
(Briefly describe the property to be searched Case : 1:18-sc-02595 
a NORMA penon He taped i ds j Assigned To : Howell, Beryl A. 
ONE ACCOUNT STORED AT PREMISES CONTROLLED } Ses tee Bre Soe — 
BY GOOGLE ) escription: searc elzure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property to be searched and give its location): 


See Attachment A 
located in the Northern District of California , there is now concealed (identify the 


person or describe the property to be seized): 
See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 
contraband, fruits of crime, or other items illegally possessed; 
om property designed for use, intended for use, or used in committing a crime; 


O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
52 U.S.C. § 30121 Foreign Contribution Ban 
18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 


The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 


days (give exact ending date if more than 30 days: _ ) is requested 


O Delayed notice of 
heet. 


under 18 U.S.C. § 3103a, the basis of which is set forth on the attache 


Applicant's signature 


Reviewed by AUSA/SAUSA: 


Kyle R. Freeny (ASC) Andrew Mitchell, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


w Daj O SERA MAS 


Judge's signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Washington, D.C. 
Printed name and title 
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FILED 


AUG -8 2018 


IN THE UNITED STATES DISTRICT COURT 
Clerk, U.S. District and 


FOR THE DISTRICT OF COLUMBIA Barkriptey Courts 
IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02595 
INFORMATION ASSOCIATED WITH Assigned To : Howell, B 
ONE ACCOUNTS STORED AT PREMISES | Assign. Date : 8/8/2018 ^ 
CONTROLLED BY GOOGLE Description: S 


€arch & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

ie I make this affidavit in support of an application for a search warrant for 
information associated with the Google account ie (“Target 
Account”), stored at premises owned, maintained, controlled or operated by Google, LLC 
(“Google”), a company headquartered in Mountain View, California. The information to be 
disclosed by Google and searched by the government is described in the following paragraphs and 
in Attachments A and B. 

2a I am a Special Agent with the Federal Bureau of Investigation (FBI), and have 
been since 2011. As a Special Agent of the FBI, I have received training and experience in 
investigating criminal and national security matters. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4, „Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contain evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 


a- 
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abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 
JURISDICTION 

Si This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Jd. §§ 2703(a), (b)(1)(A), & 
(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 


continued to make media appearances in support of the Campaign. As described further below, 


Bn 
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STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii. Jerome CORSI 

fa Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 


contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 


assessed the following: 


[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[iJn July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these ¢yber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 


figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 
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12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 


used three new accounts with the same cloud computing service to move the “snapshots” to 


those accounts. 


16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 


emails were later post on DCLeaks. 


17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 


elections in numerous Florida counties. 


18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 


against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
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presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 
C. STONE?’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’|I see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22, On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 


ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 


ee 
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aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 


day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
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[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #=WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

Bh On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. | Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer” and containing a link 


to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 
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33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 
35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 


Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
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account @wikileaks.! The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. Onor about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 


indisputably stolen from the government and the courts ruled it was legal to do so and refused to 


' On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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issue an order restraining the paper from publishing additional articles. If the US government 
moves on you J will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am-doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 


this forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with sco and Others Regarding 
Forthcoming Leaks 


41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE address On October 


17, 2017, Chief Judge Howell issued a search warrant for one of STONE’ Sa addresses, 


it Wl On or about December 19, 2017, Chief Judge Howell issued a search 


warrant i: email account. On or about March 14, 2018, Chief Judge Howell 


issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 


search warrants indicated the following: 


42. On or about May 15, oo emailed CORSI: “Here is my flight 


schedule. Need to get something confirmed now... > CORSI responded, “I copied Roger 


Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 


appears to have forwarded the message to STONE iii _ who replied to 


CORSI that, “May meet Manafort -guarantee nothing.” 


EYE 


Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 21 of 48 


43.  Onor about May 18, 2016, CORSI emailed STONE Poe) 


with the title, “Roger -- why don't you look this over before I send | I believe that 


SE 200 J did manage to see Mr. Trump for a few minutes today as we were 


waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

44. On July 25, 2016, STONE, si i sent an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

45. Onor about July 31, 2016, STONE, using MM, omailed 
CORSI with the subject line, “Call me MON.” The body of the email read should see 
Assange[.] {J should find Bernie [S]anders brother who called Bill a Rapist — turn him for 
Trump. ] ies? oH should find ie 7 2S or more proof of Bill getting kicked out.” 

46. Onor about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

“Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 


hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- 


=i 2s 


Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 22 of 48 


neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 
more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. On or about August 5, -o an associate of STONE’s, emailed 


STONE . The email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 


Julian Assange last night.” subsequently stated to investigators that, around the 


same time, STONE told him he had gone to London to meet assaNcr B also stated 


that in 2018 told STONE he would be interviewed by the FBI and would have to 


divulge the conversation about meeting ASSANGE. STONE Zo | he was joking and 


had not actually met ASSANGE.? 


48. On or about August 15, 2016, CORSI emailed STONE at 


: “Give me a call today if you can. Despite MSM drumroll that HRC is 


already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 
49. On or about August 31, 2016, CORSI emailed STONE at 


: “Did you get the PODESTA writeup.” STONE replied “[y]es.” 


ats 
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50. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 


Silt On or about September 6, 2016, CORSI emailed STONE at 


Pi aes “Roger|,] Is NY Post going to use the Pedesta [sic] stuff?” 
52. On or about September 24, o —_— emailed CORSI, “I will have much 


more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again ody j wrote back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators i indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 
53. On or about October 3, 2016, an associate of STONE emailed STONE at 
a and asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I'd say that’s 


important.” 
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54. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

55, On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

56. That same day, BANNON emailed STONE oOo “What was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his owe is a big 
democrat.” 

57. | When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. 
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58. According to a publicly available news article,’ at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

59. According to phone cor ie at approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

60. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

61. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

62. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

63. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

64. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE using ae “J expect 


that much of next dump focus, setting stage for Foundation debacle.” 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/20 1 6/10/07/31d74714-8ce5-1 1e6-875e-2c1 bfe943b66_story.html 
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65. At approximately o o an author who has written about the 


Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 

fF forwarded message to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 


G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


66. | Onor about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 


numbers.” 


67. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
in oo o emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

68. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge ithe T of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at both a with the subject 
line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 


podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 


-Je 
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“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

69. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 


CORSI back via Ho | Account, “Got them and used them.” 


70. On or about Thursday, October 13, 2016, CORSI emailed STONE at 
po “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “Pll give you one more — NOBODY YET HAS THIS[:] It looks to me 
lik 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Onc fit 


had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 


skimmed maybe billions off Skolkovo — Skolkovo kept their money with 


Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 
71. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email a with the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 


laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
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have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money Qo a controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent b o o i with the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

T2 On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

2B. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 


74. On or about October 17, 2016, CORSI emailed STONE at 
eee with the subject, “Fwd: 
ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off].]’ Only hope is that if Trump speaks out to save 


him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
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kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

T5- On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pls call. Important.” 

76. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

77. On or about November 8, 2016, the United States presidential election took place. 

78. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 

79. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


87. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
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such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. | thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 


would come under public scrutiny. . . . 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 


true. 


88. In a document dated March 26, 2018 titled “Minority Views,” Democratic 


members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 


Those excerpts include the following: 


Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 
MR. STONE: No. 


Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary — 


MR. STONE: That — 
Q: -- was the length and the breadth of what you were referring to? 
MR. STONE: That is correct, even though it was repeated to me on numerous separate 


occasions. 


89. In the month that followed his testimony before HPSCI, on or about October 24, 


2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
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Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. ... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

90. On or about November 19, 2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’........ Richard Nixon[.]” CREDICO responded, “Ha ha.” 

91. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — why are u busting my chops?” 

92. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them — which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 


about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
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interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

93. | STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

94. | Onor about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

95. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . .. Credico never said he knew or had any information as to source or 
content of the material.” 

96. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.]* You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth . . . You want me to cover you for perjury 


now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 


4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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wrong or illegal. You got the best press of your life and you can get away with asserting for Sth 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’ re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back . ... and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” 

97. | STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

98. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

99. | STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 


messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
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email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

100. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs ... +17 other pieces of information prove that | did not have any conversations with 
Assange until September of last year.” 

101. .CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee . . . But you’ ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” | 

102. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are arat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you start bringing up my dog, you’re crossing the line[.]”> 

103. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.° In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 


me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 


> https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 


é https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 


K. The Target Account 


104. According to subscriber records obtained from Google, Target Account 


Be was created on October 27, 2015, in the name E 
E= il The recovery email for the Target Account is sTONE account, 


GN. Subscriber records obtained in approximately August 2018 indicate 


that the last login to the Target Account occurred on May 17, 2018. 


105. According to subscriber records obtained from Facebook, Target Account 


Po was used to register a Facebook account in the name 7 
fe Hl which was created on October 27, 2015, with the verified telephone nom be fii 


According to a public records database, the telephone da is linked 
aaa 
106. aoe a was voluntarily interviewed by investigators from the Special 


Counsel’s Office on or about Friday, May 18, 20 told investigators that he 
became STONE’s assistant in Florida in 2015, and that during the summer of 2016, he acted as 
STONE’s right-hand man. According ‘a STONE utilized the services of several 
individuals to post social media content to Facebook and Twitter, and that he =e and 
STONE both instructed these individuals about what to post. = stated that he 
purchased a couple hundred fake Facebook accounts as part of this work (including both new 
and existing accounts), and that bloggers working for STONE would try to build what looked 


like real Facebook accounts.” ea further stated that STONE wanted to push out 


7 Facebook requires that all users of Facebook accounts use their actual name while registering 
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WikiLeaks content through his Facebook and Twitter accounts, and that content related to the 
stolen Podesta emails was pushed out through STONE’s Facebook and Twitter accounts. 


107. On or about August 2, 2018, Chief Judge Howell issued a search warrant for the 


108. Search warrant returns for STONE’s Hotmail account contain a number of emails 


that appear to have been sent to Target saaan from various 


entities, including Facebook and Twitter. Although it is not clear from the face of the emails 


Facebook account registered to Target Accou . (1:18-sw- 


2570). 


how they ended up in sonc account,® they may have been auto-forwarded or 
otherwise imported from the Target Account into oY account. These emails include at 


least one receipt sent on or about June 30, 2016, from Facebook to the Target Account for a 


Facebook advertisement, which was then forwarded from STONE account to 


= Google account.’ They also include several emails sent from 
Sar to the Target Account in early 2017. 


BACKGROUND CONCERNING GOOGLE 
109. In my training and experience, I have learned that Google provides a variety of on- 
line services, including electronic mail (“email”) access, to the public. Google allows subscribers 


to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers 


and operating their accounts. The terms of service explicitly require that “Facebook users 
provide their real names and information .... You will not provide any false personal 
information on Facebook, or create an account for anyone other than yourself without 
permission.” 


8 Investigators have been unable to access the full headers for these emails. 


i told investigators that he would sometimes send emails from STONE’s account. 
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obtain an account by registering with Google. During the registration process, Google asks 
subscribers to provide basic personal information. Therefore, the computers of Google are likely 
to contain stored electronic communications (including retrieved and unretrieved email) for 
Google Mail subscribers and information concerning subscribers and their use of Google Mail 
services, such as account access information, email transaction information, and account 
application information. In my training and experience, such information may constitute evidence 
of the crimes under investigation because the information can be used to identify the account’s 
user or users. 

110. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

111. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(i.e., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 


logging into the account via the provider’s website), and other log files that reflect usage of the 
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account. In addition, email providers often have records of the IP address used to register the 
account and the IP addresses associated with particular logins to the account. Because every device 
that connects to the Internet must use an IP address, IP address information can help to identify 
which computers or other devices were used to access the email account. 

112. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

113. This application seeks a warrant to search all responsive records and information 
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where 
Google has chosen to store such information. The government intends to require the disclosure 
pursuant to the requested warrant of the contents of wire or electronic communications and any 
records or other information pertaining to the customers or subscribers if such communication, 
record, or other information is within Google’s possession, custody, or control, regardless of 
whether such communication, record, or other information is stored, held, or maintained outside 
the United States. 

114. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 


under investigation, thus enabling the United States to establish and prove each element or 
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alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time (e.g., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g., communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 
FILTER REVIEW PROCEDURES 
115. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 


with professional responsibility requirements concerning the maintenance of attorney-client and 


Be. 


Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 42 of 48 


other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
CONCLUSION 
116. Based on the forgoing, I request that the Court issue the proposed search warrant. 


117. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 


required for the service or execution of this warrant. 


REQUEST FOR SEALING 


118. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


a“ = 


Pa 


Andrew Mitchell 
Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on thisf fA day of August, 2018. 


Lay f ptl 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Google accounts, which 
are stored at premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a 


company headquartered in Mountain View, California: 
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ATTACHMENT B 


I. Information to be disclosed by Google 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 


information that have been deleted but are still available to Google, or have been preserved 


pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 


information to the government for each account listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

The types of service utilized; 

All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 
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€. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 


actions taken; 


f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

fy All Google Analytics information associated with the account (including all 


properties and UA codes associated with the account, and, for each of these 


proprieties and UA codes, all usernames and email accounts associated with them); 


J All Google Developers Console information associated with the account; 
k. All Minutemaid information associated with the account; 

E All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; 


q. All Web & App Activity associated with the account; 


2 All Google Drive information associated with the account; 
S. All Google+ information associated with the account; 
2 All device information associated with the account, including all instrument or 


telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 


Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 


. 


Case 1:19-mc-00029-CRC Document 29-15 Filed 04/28/20 Page 46 of 48 


Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (‘IMSI”), or 
International Mobile Equipment Identities (“IMEI”)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 
II. Information to be Seized by the Government 
Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2015 to the present, including: 


Ac 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome orai Julian 


individual associated with the Trump Campaign; 

C; Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 
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m. 


Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

All existing printouts from original storage which concern the categories identified 


in subsection II.a. 


FA 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH ONE ACCOUNT 
STORED AT PREMISES 
CONTROLLED BY TWITTER 


SEARCH AND SEIZURE WARRANT 


Case: 1:18-sc-02596 

Assigned To : Howell, Beryl A. 

Assign. Date : 8/8/2018 

Description: Search & Seizure Warrant 


eee Ne ae ae ae 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of 7 California o 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before August 21, 2018 (not to exceed 14 days) 
@ in the daytime 6:00 a.m. to 10:00 p.m. Cat any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) © until, the facts justifying, the later specific date of 


Date and time issued: C/9/ rf aff 3 ofh PAET MA SED 


Judge's signature 


Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge © i 


City and state: trict Ju 
Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 
Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 


designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Twitter accounts, which 
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. (“Twitter”), a 


company headquartered in San Francisco, California: 


I. 
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ATTACHMENT B 
Information to be disclosed by Twitter 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Twitter, Inc. (“Twitter”), including any messages, records, files, logs, or 


information that have been deleted but are still available to Twitter, or have been preserved 


pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following 


information to the government for each account listed in Attachment A: 


A. 


All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the account, 
and all photographs or images included in those Tweets and Direct Messages; 


The content of all communications (public or private) sent to or from, stored in draft form 
in, or otherwise associated with the account, including the content of all messages, 
attachments, and header information; 


All data and information associated with the profile page, including photographs, “bios,” 
and profile backgrounds and themes; 


All other content associated with the account, including, but not limited to, posts, 
documents, spreadsheets, photos, and videos; 


All information from the "Connect" tab for the account, including all lists of Twitter users 
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets 
that include the username associated with the account (i.e., “mentions” or “replies”); 


All photographs and images in the user gallery for the account; 


All location data associated with the account, including all information collected by the 
“Tweet With Location” service; 


All information about the account's use of Twitter’s link service, including all longer 
website links that were shortened by the service, all resulting shortened links, and all 
information about the number of times that a link posted by the account was clicked; 


All data and information that has been deleted by the user; 


A list of all of the people that the user follows on Twitter and all people who are following 
the user (i.e., the user’s “following” list and “followers” list); 


A list of all users that the account has “unfollowed” or blocked; 


All “lists” created by the account; 


a 
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All information on the “Who to Follow” list for the account; 
All privacy and account settings; 


All records of Twitter searches performed by the account, including all past searches saved 
by the account; 


All current and historical subscriber and payment information, including full name, e-mail 
address (including any secondary or recovery email addresses), physical address (including 
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number, 
websites, screen names, user identification numbers, security questions and answers, 
registration IP address, payment history, and other personal identifiers; 


All email addresses and telephone numbers ever registered (whether successfully or not) 
to the account, including dates of any changes and the IP addresses used for any changes; 


All past and current usernames, account passwords, and names associated with the account, 
including dates of any changes and the IP addresses used for any changes; 


All data and information associated with the profile page, including photographs; 


All advertising data relating to the account, including, but not limited to, information 
regarding unique advertising IDs associated with the user, any devices used to access the 
account, application IDs, UDIDs, payment information (including, but not limited to, full 
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads 
created; 


The dates and times at which the account and profile were created, and the Internet Protocol 
(“IP”) address at the time of sign-up; 


All transactional records associated with the account, including any IP logs or other records 
of session times and durations; 


Any information identifying the device or devices used to access the account, including a 
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers, 
MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers 
(“MEIN”), Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services 
Digital Network Number (“MSISDN”), International Mobile Subscriber Identifiers 
(“IMSI”), or International Mobile Equipment Identities (“IMEI”), and any other 
information regarding the types of devices used to access the account; 


All activity logs for the account; 


All location information for the account, including all location data collected by any 
plugins or widgets; 


The types of service utilized by the user; 


Hes 


AA. 


BB. 


CG. 


DD. 


EE. 


FF. 


GG. 


HH. 


II. 


II. 
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All information about the account’s use of Twitter’s link service, including all website links 
embedded in, exporting data to, or importing data from, the account’s website or blog; 


All full website links that were shortened by Twitter’s link service, all resulting shortened 
links, and all information about the number of times that a link posted by the account was 
clicked; 


All information about connections between the account and third-party websites and 
applications, including any Twitter, Facebook or other social networking accounts to which 
posts from the account are sent; 


All data and information that has been deleted by the user; 


The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 


All privacy settings and other account settings, including email addresses or other accounts 
that the account has blocked; 


Information regarding linked accounts, including accounts linked by cookie, IP address 
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie 
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device 
identifier, or any other account or device identifier; 


Information regarding accounts linked to accounts to which the Target Accounts are linked; 


All records pertaining to communications between the Service Provider and any person 
regarding the user or the user’s account with the Service Provider, including contacts with 
support services, records of actions taken, and investigative or user complaints concerning 
the subscriber. 


Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2015 to the present, including: 


Ae 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, Julian 


Assange, Randy Credico, or any 
individual associated with the Trump Campaign; 

eA Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

€. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

i Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 


any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 


Sa 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 


in subsection Il.a. 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT FILE p 


District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED 
BY TWITTER 


AUG ~ 8 2018 


Clerk, U.S. District and 
Bankruptey-Courts————— 


Case: 1:18-sc-02596 
Assigned To : Howell, Beryl A. 


Assign. Date : 8/8/2018 
Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property to be searched and give its location): 


See Attachment A 
located in the Northern District of 


California _, there is now concealed (identify the 


person or describe the property to be seized): 
See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 


Mf evidence of a crime; 


Wf contraband, fruits of crime, or other items illegally possessed; 
om property designed for use, intended for use, or used in committing a crime; 


O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section 
52 U.S.C. § 30121 


Foreign Contribution Ban 


Offense Description 


18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 


See Affidavit for add'l 


The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 
O Delayed notice of 


Reviewed by AUSA/SAUSA: 


Kyle R. Freeny (ASC) 


Sworn to before me and signed in my presence. 


pas _ S/P) 2319 


City and state: Washington, D.C. 


days (give exact ending date if more than 30 days: _ 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached-sheet. 


) is requested 


Applicant's signature 


Andrew Mitchell, Special Agent, FBI 


Printed name and title 


S74 Gh EAG 


Judge's signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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IN THE UNITED STATES DISTRICT COURT AUG - 2018 
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District ang 
Bankruptcy Courts 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02596 
INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A 

ONE ACCOUNT STORED AT PREMISES Assign. Date : 8/8/2018 l 
CONTROLLED BY TWITTER Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

iB I make this affidavit in support of an application for a search warrant for 
information associated with the Twitter oon (“Target Account”), stored 
at premises owned, maintained, controlled or operated by Twitter, Inc. (“Twitter”), a company 
headquartered in San Francisco, California. The information to be disclosed by Twitter and 
searched by the government is described in the following paragraphs and in Attachments A and B. 

2 I am a Special Agent with the Federal Bureau of Investigation (FBI), and have 
been since 2011. As a Special Agent of the FBI, I have received training and experience in 
investigating criminal and national security matters. 

B; The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contain evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


ajs 
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U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure bart There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 
JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 
(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 


ii. Jerome CORSI 


iS 
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7. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 


contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 


B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9; On January 6, 2017, the USIC released a declassified version of an intelligence 


ie 
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assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 


release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 


13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
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contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 
19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 


unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 


as 
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Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

2A On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’!l see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22; On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 


to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 


-6- 
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later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

2s On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Chery] Mills, the 


Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 
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28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. | Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33; WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 


emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
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think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Chery] Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. | On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35s On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks.' The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 


Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 


' On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneSr. 


i: 
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to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 


squeeze us into a deal.” 


-10- 
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40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 


this forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with stone and Others Regarding 
Forthcoming Leaks 


41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 
issued a search warrant for STONE S saaressa On October 
17, 2017, Chief Judge Howell issued a search warrant for one of sToNE addresses, 

On or about December 19, 2017, Chief Judge Howell issued a search 
warrant fo email account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. On or about May 15, 201 | emailed CORSI: “Here is my flight 
schedule. Need to get something confirmed now... .” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 


appears to have forwarded the message to STONE Do who replied to 


CORSI that, “May meet Manafort -guarantee nothing.” 


43.  Onor about May 18, 2016, CORSI emailed STONE a 
with the title, “Roger -- why don't you look this over before I send a: I believe that 


CORSI wrote, 


and J did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 


was very cordial. He would look for this memo from you this afternoon.” 


ave 
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44, On July 25, 2016, STONE, vin sent an email to 


CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

45. On or about July 31, 2016, STONE, an. emailed 
CORSI with the subject line, “Call me MON.” The body of the email read, should see 
Assange! should find Bernie [S]anders brother who called Bill a Rapist — turn him for 
Trump[. = should in j or more proof of Bill getting kicked out.” 

On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 
a= “Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. On or about August 5, 2016 an associate of STONE’s, emailed 
STONE Joo The email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
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Julian Assange last nich i subsequently stated to investigators that, around the 


same time, STONE told him he had gone to London to meet assan also stated 
that in 201 mwa told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE i he was joking and 
had not actually met ASSANGE.? 

48. On or about August 15, 2016, CORSI emailed STONE at 

ae “Give me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

49. On or about August 31, 2016, CORSI emailed STONE at 

PY “Did you get the PODESTA writeup.” STONE replied “[y]es.” 

50. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 


SI. On or about September 6, 2016, CORSI emailed STONE at 


| —ae Is NY Post going to use the Pedesta [sic] stuff?” 
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52. On or about September 24, 0 emailed CORSI, “I will have much 


more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 


it again ody wrote back, “Awaiting secret file. Explosive... Hope you are well. 


Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators mm indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

53. On or about October 3, 2016, an associate of STONE emailed STONE at 

= === and asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

54. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 


vowed that the U.S. election-related documents would all come out before Election Day. 


he 
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55; On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

56. That same day, BANNON emailed STONE hit. “What was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his awe is a big 
democrat.” 

57. | When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. 


58. According to a publicly available news article,* at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 


calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 


3 https:/Awww.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/31d74714-8ce5-1 1e6-875e-2c1bfe943b66_story.html 
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59. According to phone oora. at approximately 


11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

60. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

61. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

62. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

63. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

64. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE a “I expect 


that much of next dump focus, setting stage for Foundation debacle.” 


65. At approximately 6:2 rM B. an author who has written about the 


Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 


newly-released Podesta emails. Approximately ten minutes later, STONE, using 


= << ETEN message to CORSI without comment. STONE 


does not appear to have forwarded the email to any other individual. 
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G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


66. Onor about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 


numbers.” 

67. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
vin emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

68. Onor about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at le with the subject 
line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

69. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 


CORSI back via the Hotmail Account, “Got them and used them.” 


Jes 
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70. On or about Thursday, October 13, 2016, CORSI emailed STONE at 
PT “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I'll give you one more — NOBODY YET HAS THIS[:] It looks to me 
in skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 
71. Onor about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email aos with the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor J have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did (oes a controversial Russian billionaire 


investor with ties to the Vladimir Putin and the Russian government, launder through 


Metcombank, a Russian regional bank owned 99.978 percent | with the money 
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transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

72. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

73: On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 

74. On or about October 17, 2016, CORSI emailed STONE at 

a | with the subject, “Fwd: 

ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off].]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

75. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 


“Pls call. Important.” 
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76. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

77. On or about November 8, 2016, the United States presidential election took place. 

78. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 

79. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 
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J. STONE?’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


87. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 


I. 
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does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. .. . 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 


true. l 

88. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 


Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 
MR. STONE: No. 


Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 


you were only referring to a single fact that you had confirmed with the intermediary — 
MR. STONE: That — 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 


occasions. 

89. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. ... [M]y tweet referred to Podesta’s business dealings with Russia, and the 


expectation that it would become a news story.” 
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J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

90. | On or about November 19, 2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’........ Richard Nixon[.]” CREDICO responded, “Ha ha.” 

91. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — why are u busting my chops?” 

92. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them — which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stutt].| 1 just followed his tweets|.|” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 


guess Schiff will try to get one of us indicted for perjury[.]” 
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93. | STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

94. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

95. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 
content of the material.” 

96. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.]* You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth . . . You want me to cover you for perjury 
now([.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 


a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 


4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back . . . and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before | testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” 

97. | STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

98. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

99. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would.do my show[.] That was my 


initial contact.” 
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100. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs ... + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

101. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee . . . But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

102. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you start bringing up my dog, you’re crossing the line[.]”° 

103. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.° In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 


He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 


have prostate cancer and did not have any such discussion with STONE. 


> https://Awww.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 


6 https://www.motherjones.com/politics/20 1 8/05/roger-stone-to-associate-prepare-to-die/ 
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‘ia Statements Regarding STONE’s Use of Social Media 
104. On or about Friday, May 18, 201 FY was voluntarily interviewed 


by investigators from the Special Counsel’s orcs told investigators that he became 


STONE’s assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE’s 


right-hand man. 


105. According i STONE utilized the services of several individuals to 


post social media content to Facebook and Twitter, and that he = È and STONE both 
instructed these individuals about what to rost stated that he purchased a couple 
hundred fake Facebook accounts as part of this work (including both new and existing accounts), 


and that bloggers working for STONE would try to build what looked like real Facebook 


accounts. 


106. m further stated that STONE wanted to push out WikiLeaks content 


through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails 
was pushed out through STONE’s Facebook and Twitter accounts. 


L. The Target Account 


107. The Target Account is a Twitter account with aaam 


Search warrant returns for STONE’s Hotmail account contain emails from Twitter about Target 


No which appear to have originally been sent to 


Although it is not clear from the face of the emails how they 


ended up in STONE’s Hotmail account,’ they may have been auto-forwarded or otherwise 


imported a : the Hotmail account. Subscriber records 


7 Investigators have been unable to access the full headers for these emails. 
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obtained from Google show th was registered using STONE’s 


Hotmail addres , as the recovery account.® 

108. Tweets associated with the Target Account, which are publicly available, include 
the retweeting of content related to WikiLeaks, STONE’s testimony before the House 
Intelligence Committee, and the hacking of the DNC. The Target Account was also used to 
retweet content with the hashtag #FreeAssange! The Target Account is listed as having been 
created in March 2016 and bears the picture of a person purporting to fe = 

109. In my training and experience, I know that, in addition to posting content and 
purchasing advertisements, Twitter accounts can be used to communicate privately and directly 
with other users through Twitter’s direct messaging function. As noted above, STONE used at 
least one other Twitter account, @RogerJStoneJr, to communicate with WikiLeaks and 
ASSANGE in 2016 and 2017. 

BACKGROUND CONCERNING TWITTER 

110. Twitter owns and operates a free-access social-networking website of the same 
name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own 
profile pages, which can include a short biography, a photo of themselves, and location 
information. Twitter also permits users create and read 140-character messages called “Tweets,” 
and to restrict their “Tweets” to individuals whom they approve. These features are described in 
more detail below. 

111. Upon creating a Twitter account, a Twitter user must create a unique Twitter 


username and an account password, and the user may also select a different name of 20 


as also used to register a Facebook account. This Court 
authorized a search of that Facebook account on or about August 2, 2018 (1:18-sw-2570). 
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characters or fewer to identify his or her Twitter account. The Twitter user may also change this 
username, password, and name without having to open a new Twitter account. 

112. Twitter asks users to provide basic identity and contact information, either during 
the registration process or thereafter. This information may include the user’s full name, e-mail 
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown, 
occupation, and other personal identifiers. For each user, Twitter may retain information about 
the date and time at which the user’s profile was created, the date and time at which the account 
was created, and the Internet Protocol (“IP”) address at the time of sign-up. Because every 
device that connects to the Internet must use an IP address, IP address information can help to 
identify which computers or other devices were used to access a given Twitter account. 

113. A Twitter user can post a personal photograph or image (also known as an 
“avatar”) to his or her profile, and can also change the profile background or theme for his or her. 
account page. In addition, Twitter users can post “bios” of 160 characters or fewer to their profile 
pages. 

114. Twitter also keeps IP logs for each user. These logs contain information about the 
user’s logins to Twitter including, for each access, the IP address assigned to the user and the 
date stamp at the time the user accessed his or her profile. 

115. As discussed above, Twitter users can use their Twitter accounts to post “Tweets” 
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was 
posted to Twitter. Twitter users can also “favorite,” “retweet,” or reply to the Tweets of other 
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign, 
Twitter designates that Tweet a “mention” of the identified user. In the “Connect” tab for each 


account, Twitter provides the user with a list of other users who have “favorited” or “retweeted” 
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the user’s own Tweets, as well as a list of all Tweets that include the user’s username (i.e., a list 
of all “mentions” and “replies” for that username). 

116. Twitter users can include photographs or images in their Tweets. Each Twitter 
account also is provided a user gallery that includes images that the user has shared on Twitter, 
including images uploaded by other services. 

117. Twitter users can also opt to include location data in their Tweets, which will 
reveal the users’ locations at the time they post each Tweet. This “Tweet With Location” 
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users 
may delete their past location data. 

118. When Twitter users want to post a Tweet that includes a link to a website, they 
can use Twitter’s link service, which converts the longer website link into a shortened link that 
begins with http://t.co. This link service measures how many times a link has been clicked. 

119. A Twitter user can “follow” other Twitter users, which means subscribing to 
those users’ Tweets and site updates. Each user profile page includes a list of the people who are 
following that user (i.e., the user’s “followers” list) and a list of people whom that user follows 
(i.e., the user’s “following” list). Twitters users can “unfollow” users whom they previously 
followed, and they can also adjust the privacy settings for their profile so that their Tweets are 
visible only to the people whom they approve, rather than to the public (which is the default 
setting). A Twitter user can also group other Twitter users into “lists” that display on the right 
side of the user’s home page on Twitter. Twitter also provides users with a list of “Who to 
Follow,” which includes a few recommendations of Twitter accounts that the user may find 


interesting, based on the types of accounts that the user is already following and who those 


people follow. 
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120. In addition to posting Tweets, a Twitter user can also send Direct Messages 
(DMs) to one of his or her followers. These messages are typically visible only to the sender and 
the recipient, and both the sender and the recipient have the power to delete the message from the 
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a 
particular user, but older DMs are stored on Twitter’s database. 

121. Twitter users can configure the settings for their Twitter accounts in numerous 
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the 
user’s mobile phone, and the user can also set up a “sleep time” during which Twitter updates 
will not be sent to the user’s phone. 

122. Twitter includes a search function that enables its users to search all public 
Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to 
25 past searches. 

123. Twitter users can connect their Twitter accounts to third-party websites and 
applications, which may grant these websites and applications access to the users’ public Twitter 
profiles. 

124. Ifa Twitter user does not want to interact with another user on Twitter, the first 
user can “block” the second user from following his or her account. 

125. In some cases, Twitter users may communicate directly with Twitter about issues 
relating to their account, such as technical problems or complaints. Social-networking providers 
like Twitter typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 


the provider or user as a result of the communications. Twitter may also suspend a particular user 
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for breaching Twitter’s terms of service, during which time the Twitter user will be prevented 
from using Twitter’s services. 

126. As explained herein, information stored in connection with a Twitter account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Twitter user’s account information, IP log, stored electronic communications, and other data 
retained by Twitter, can indicate who has used or controlled the Twitter account. This “user 
attribution” evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence. For example, profile contact information, communications, 
“tweets” (status updates) and “tweeted” photos (and the data associated with the foregoing, such 
as date and time) may be evidence of who used or controlled the Twitter account at a relevant 
time. Further, Twitter account activity can show how and when the account was accessed or 
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from 
which users access their accounts along with the time and date. By determining the physical 
location associated with the logged IP addresses, investigators can understand the chronological 
and geographic context of the account access and use relating to the crime under investigation. 
Such information allows investigators to understand the geographic and chronological context of 
Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter 
builds geo-location into some of its services. If enabled by the user, physical location is 
automatically added to “tweeted” communications. This geographic and timeline information 
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account 


activity may provide relevant insight into the Twitter account owner’s state of mind as it relates 
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to the offense under investigation. For example, information on the Twitter account may 
indicate the owner’s motive and intent to commit a crime (e.g., information indicating a criminal 
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal 
evidence from law enforcement). 

127. Therefore, the computers of Twitter are likely to contain all the material described 
above, including stored electronic communications and information concerning subscribers and 
their use of Twitter, such as account access information, transaction information, and other account 
information. 

FILTER REVIEW PROCEDURES 

128. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

129. Based on the forgoing, J request that the Court issue the proposed search warrant. 

130. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

131. I further request that the Court order that all papers in support of this application, 

including the affidavit and search warrant, be sealed until further order of the Court. These 


documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
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known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 
Respectfully submitted, 


Lie tip 


Andrew Mitchell 
Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this g fA say of August, 2018. 


Daf t Map 


The Honorable Beryl A. Howell 
Chief United States District Judge 


BBa 


Case 1:19-mc-00029-CRC Document 29-16 Filed 04/28/20 Page 45 of 50 


ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Twitter accounts, which 
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. (“Twitter”), a 


company headquartered in San Francisco, California: 


I. 
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ATTACHMENT B 


Information to be disclosed by Twitter 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Twitter, Inc. (“Twitter”), including any messages, records, files, logs, or 


information that have been deleted but are still available to Twitter, or have been preserved 


pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following 


information to the government for each account listed in Attachment A: 


A. 


All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the account, 
and all photographs or images included in those Tweets and Direct Messages; 


The content of all communications (public or private) sent to or from, stored in draft form 
in, or otherwise associated with the account, including the content of all messages, 
attachments, and header information; 


All data and information associated with the profile page, including photographs, “bios,” 
and profile backgrounds and themes; 


All other content associated with the account, including, but not limited to, posts, 
documents, spreadsheets, photos, and videos; 


All information from the "Connect" tab for the account, including all lists of Twitter users 
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets 
that include the username associated with the account (i.e., “mentions” or “replies”); 


All photographs and images in the user gallery for the account; 


All location data associated with the account, including all information collected by the 
“Tweet With Location” service; 


All information about the account's use of Twitter’s link service, including all longer 
website links that were shortened by the service, all resulting shortened links, and all 
information about the number of times that a link posted by the account was clicked; 


All data and information that has been deleted by the user; 


A list of all of the people that the user follows on Twitter and all people who are following 
the user (i.e., the user’s “following” list and “followers” list); 


A list of all users that the account has “unfollowed” or blocked; 
All “lists” created by the account; 
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All information on the “Who to Follow” list for the account; 
All privacy and account settings; 


All records of Twitter searches performed by the account, including all past searches saved 
by the account; 


All current and historical subscriber and payment information, including full name, e-mail 
address (including any secondary or recovery email addresses), physical address (including 
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number, 
websites, screen names, user identification numbers, security questions and answers, 
registration IP address, payment history, and other personal identifiers; 


All email addresses and telephone numbers ever registered (whether successfully or not) 
to the account, including dates of any changes and the IP addresses used for any changes; 


All past and current usernames, account passwords, and names associated with the account, 
including dates of any changes and the IP addresses used for any changes; 


All data and information associated with the profile page, including photographs; 


All advertising data relating to the account, including, but not limited to, information 
regarding unique advertising IDs associated with the user, any devices used to access the 
account, application IDs, UDIDs, payment information (including, but not limited to, full 
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads | 


created; 


The dates and times at which the account and profile were created, and the Internet Protocol 
(“IP”) address at the time of sign-up; 


All transactional records associated with the account, including any IP logs or other records 
of session times and durations; 


Any information identifying the device or devices used to access the account, including a 
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers, 
MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers 
(“MEIN”), Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services 
Digital Network Number (“MSISDN”), International Mobile Subscriber Identifiers 
(“IMSI”), or International Mobile Equipment Identities (“IMEI”), and any other 
information regarding the types of devices used to access the account; 


All activity logs for the account; 


All location information for the account, including all location data collected by any 
plugins or widgets; 


The types of service utilized by the user; 
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AA. 


BB. 


CG. 


DD. 


EE. 


FF. 


GG. 


HH. 


I. 


II. 


All information about the account’s use of Twitter’s link service, including all website links 
embedded in, exporting data to, or importing data from, the account’s website or blog; 


All full website links that were shortened by Twitter’s link service, all resulting shortened 
links, and all information about the number of times that a link posted by the account was 
clicked; 


All information about connections between the account and third-party websites and 
applications, including any Twitter, Facebook or other social networking accounts to which 
posts from the account are sent; 


All data and information that has been deleted by the user; 


The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 


All privacy settings and other account settings, including email addresses or other accounts 
that the account has blocked; 


Information regarding linked accounts, including accounts linked by cookie, IP address 
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie 
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device 
identifier, or any other account or device identifier; 


Information regarding accounts linked to accounts to which the Target Accounts are linked; 


All records pertaining to communications between the Service Provider and any person 
regarding the user or the user’s account with the Service Provider, including contacts with 
support services, records of actions taken, and investigative or user complaints concerning 
the subscriber. 


Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2015 to the present, including: 


4. 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, an Julian 


individual associated with the Trump Campaign; 

C: Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

É; All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f; Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

ii Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

k The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 


o. All existing printouts from original storage which concern the categories identified 


in subsection Il.a. 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 


: Case: 1:18-sc-02670 
or identify the person by name and address) ) 

) 

) 


Assigned To : Howell, Beryl A. 
Assign. Date : 8/20/2018 


INFORMATION ASSOCIATED WITH ONE ACCOUNT 
Description: Search & Seizure Warrant 


STORED AT PREMISES CONTROLLED BY 1&1 MAIL 
& MEDIA, INC. 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Eastern District of Pennsylvania 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before September 3, 2018 (not to exceed 14 days) 
@ in the daytime 6:00 a.m. to 10:00 p.m. O at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to Hon. Rudolph Contreras, U.S. District Judge 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 


O for days (not to exceed 30) C until, the facts justifying, the later specific date of 
Date and time issued: __ k J: 20/2018 S 207 pas a J 
É S signature 
City and state: Washington, DC Hon. Rudolph Contreras, U.S. District Judge 


Printed name and title 


Case 1:19-mc-00029-CRC Document 29-17 Filed 04/28/20 Page 2 of 33 


AO 93 (Rev. ! 1/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 
Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following 1&1 Mail account, which 


is stored at premises owned, maintained, controlled, or operated by 1&1 Mail & Media, Inc., a 


company headquartered in Chesterbrook, Pennsylvania: 


Pi 
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ATTACHMENT B 


L Information to be disclosed by 1&1 Mail 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of 1&1 Mail & Media, Inc. (the “Provider”), including any messages, records, 


files, logs, or information that have been deleted but are still available to the Provider, or have 


been preserved pursuant to a request made under 18 U.S.C. § 2703(f), the Provider is required to 


disclose the following information to the government for each account listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

The types of service utilized; 

All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 


2. 
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ë. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 


actions taken; 


f. All subscriber “change history” associated with the account; 
g. Al search history and web history associated with the account; 
h. All location and maps information associated with the account; 


i, All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMST”), or 
International Mobile Equipment Identities (“IMEI’’)); and 

i For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 


source of payment (including any credit or bank account number). 
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I. Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 


U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud); 


and 52 U.S.C. § 30121 (foreign contribution ban), including: 


a. 


b. 


Evidence of unauthorized access to protected computers; 

Evidence of the distribution or transfer of data obtained through unauthorized 
access to protected computers; 

Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

Evidence indicating the account owner’s state of mind as it relates to the crimes 
under investigation; 

The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 


principals; 
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h. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

le The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)\—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

Ji The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 


foreign government, foreign officials, foreign entities, foreign persons, or foreign 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT AUG 20 2018 


for the Clerk, U.S. District & Bankruptcy 
Disier of Columbia Courts for the District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH ONE ACCOUNT 
STORED AT PREMISES CONTROLLED BY 1&1 MAIL & 
MEDIA, INC. 


Case: 1:18-sc-02670 

Assigned To : Howell, Beryl A. 

Assign. Date : 8/20/2018 

Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 

located in the Eastern District of Pennsylvania , there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 
W contraband, fruits of crime, or other items illegally possessed; 
wm property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
52 U.S.C. § 30121 Foreign Contribution Ban 
18 U.S.C. §§ 1030, 371 Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 
The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: > sl oe 


Kyle R. Freeny (ASC) Patrick J. Myers, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


Date: f J 20 [dot 4 WA <a 


Judge's signature 


City and state: Washington, D.C. Hon. Rudolph Contreras, U.S. District Judge 


Printed name and title 
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FILED 


IN THE UNITED STATES DISTRICT COURT AUG 2 0 2018 


FOR THE DISTRICT OF COLUMBIA pi 
Clark, U.S, Distriet & Bankruptey 


Courts tor the District af Oelumbia 
IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH Case: 1:18-sc-02670 
ONE ACCOUNT STORED AT PREMISES Assigned To : Howell, Beryl A. 
CONTROLLED BY 1&1 MAIL & MEDIA, Assign. Date : 8/20/2018 
INC. Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

k I make this affidavit in support of an application for a search warrant for 
information associated with the account = Account”), stored at 
premises owned, maintained, controlled or operated by 1&1 Mail & Media, Inc. (“1&1 Mail”), a 
company headquartered in Chesterbrook, Pennsylvania. The information to be disclosed by 1&1 
Mail and searched by the government is described in the following paragraphs and in Attachments 
A and B. 

2, I am a Special Agent with the Federal Bureau of Investigation (“FBP”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 

8. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses, This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 


does not set forth all of my knowledge about this matter. 


=e 
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4, Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contain evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 951 (acting as an unregistered foreign agent), 18 U.S.C. § 1030 (unauthorized access of 
a protected computer), 18 U.S.C. § 1343 (wire fraud), and 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). 
There also is probable cause to search the information described in Attachment A for evidence, 


contraband, fruits, and/or instrumentalities of the Subject Offenses, further described in 


Attachment B. 
JURISDICTION 
5: This Court has jurisdiction to issue the requested warrant because it is “a court of 


competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 

(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 

judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 2711(3)(A)(Gi). The offense conduct included activities in Washington, D.C., as detailed below. 
PROBABLE CAUSE 


A. Russian Government-Backed Hacking Activity during the 2016 Presidential 
Election 


6. On June 14, 2016, the cybersecurity firm CrowdStrike, Inc. and its affiliates 


(“CrowdStrike”) published a blog post entitled, “Bears in the Midst: Intrusion into the 


De 
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Democratic National Committee.”! In the blog post, CrowdStrike described how the firm “was 
called by the Democratic National Committee (DNC), the formal governing body for the US 
Democratic Party, to respond to a suspected breach.” According to CrowdStrike, the cyber actor 
known as “Fancy Bear” breached the DNC network in 2016. CrowdStrike further assessed: 
“Extensive targeting of defense ministries and other military victims [by FANCY BEAR] has 
been observed, the profile of which closely mirrors the strategic interests of the Russian 
government, and may indicate affiliation with 'napyHoe PaspegpiBatenbHoe Yupasienne (Main 
Intelligence Department) or GRU, Russia’s premier military intelligence service.” 

T: Starting in or around mid-2016, published reports also detailed attempts to 
compromise both the work and personal email accounts of numerous individuals involved in the 
2016 U.S. presidential campaign through “spearphishing” efforts. In this context, spear phishing 
refers to the fraudulent practice of sending an email that purports to be from a known or trusted 
sender in order to induce the targeted victim to respond in a desired manner, typically by clicking 
a malicious link or URL. The perpetrators used Bitly, a link-shortening and management service, 
to disguise the malicious URLs. Victims of these spearphishing efforts included John Podesta, the 
chairman of the Clinton Campaign, who received a spearphishing email on or about March 19, 
2016. The email contained a Bitly link created by the Bitly account john356gh, which the FBI has 
linked to a known GRU officer. 

8. On or about September 20, 2016, CrowdStrike also identified a new intrusion into 


the DNC’s virtual private cloud, hosted by Amazon Web Services (AWS). CrowdStrike advised 


' “Bears in the Midst: Intrusion into the Democratic National Committee,” June 14, 2016, 
available at https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national- 
committee. 
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the FBI that the perpetrators obtained unauthorized access to the DNC’s VPC system through the 
theft of an administrator credential, which gave the perpetrators the ability to modify the network’s 
security rules. After gaining this access, the perpetrators modified the rules that limited the 
universe of devices that could connect to the victim computers. Based on its forensic analysis, 
CrowdStrike determined that the perpetrators copied snapshots of the DNC’s cloud-based 
computers onto at least three new AWS accounts created by the perpetrators. 

9, Following the inception of the spear phishing and intrusion campaigns, a series of 
overlapping actors began to be release documents stolen from the DNC, DCCC, and the personal 
email accounts of campaign-affiliated individuals. Release of these stolen documents principally 
occurred through three forums: (1) a series of accounts operated under the online persona 
“Guccifer 2.0”; (2) a website and series of accounts operated under the online persona “DCLeaks”; 
and (3) the websites and public archives operated by the group “Wikileaks.” The releases of stolen 
documents included confidential memoranda written by Democratic employees; strategy 
documents discussing various components of the 2016 federal elections; and confidential 
correspondences of the DNC and DCCC, as well as individuals involved in the presidential 
campaign of Hillary Clinton. 

10. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 


US presidential election. Russia’s goals were to undermine public faith.in the US 


2 “Assessing Russian Activities and Intentions in Recent US Elections,” Jan. 6, 2017, available at 
https://www.dni.gov/files/documents/ICA_2017_01.pdf. 


wiih 
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democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

jE he In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

12. With respect to hacking activity, the USIC assessed: “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” In addition, “In July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC further assessed that cyber 
operations by Russian military intelligence (General Staff Main Intelligence Directorate or GRU) 
“resulted in the compromise of the personal e-mail accounts of Democratic Party officials and 
political figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

13. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release 
US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

14. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 


presidential election, including conspiracy to commit authorized access to protected computers. 


(Case No. 1:18-cr-00125). 
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B. Guccifer 2.0’s Use of WikiLeaks to Further the Interference in the 2016 U.S. 
Presidential Election 


15. On June 15, 2016, the day after CrowdStrike publicly attributed the DNC hack to 
Russian government actors, the persona Guccifer 2.0 published its first post on a WordPress 
blog, publicly claiming responsibility for the hack. The post, titled “GUCCIFER 2.0 DNC’S 
SERVERS HACKED BY A LONE HACKER,” contained a number of documents that Guccifer 
2.0 represented as “docs I downloaded from the Democrats network.” Guccifer 2.0 also stated in 
the same post that, with respect to the documents stolen from the DNC, “[t]he main part of the 
papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 

16. According to open source information, WikiLeaks is a self-described anti-secrecy 
organization, which is responsible for releasing stolen documents from a number of government 
and non-governmental entities. Julian Assange, an Australian citizen, founded WikiLeaks in or 
around 2006, and he has stated in public interviews that he is deeply involved in running the 
organization. 

LT On or about June 20, 2016, Guccifer 2.0 registered the Twitter account 
@GUCCIFER 2. Search warrant returns for that Twitter account show that Guccifer 2.0 
communicated via direct message with WikiLeaks’ Twitter account, @wikileaks, about the stolen 
DNC documents, including about ways to maximize the impact of the documents on the 2016 
U.S. presidential election. For example, on or about June 22, 2016, WikiLeaks sent a private 
message to Guccifer 2.0, via Twitter, telling Guccifer 2.0 to “[s]end any new material [stolen 
from the DNC] here for us to review and it will have a much higher impact than what you are 
doing.” On or about July 6, 2016, WikiLeaks stated, “if you have anything hillary related we 
want it in the next tweo [sic] days prefable [sic] because the DNC [Democratic National 


Convention] is approaching and she will solidify Bernie supporters behind her after.” Guccifer 


J- 
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2.0 responded, “ok... I see.” WikiLeaks explained, “we think trump has only a 25% chance of 
winning against Hillary . . . so conflict between Bernie and Hillary is interesting.” 

18. According to information obtained through a court-authorized search of the 
Target Account conducted in or around August 2016, I know that on or about July 14, 2016, 
Guccifer 2.0 sent WikiLeaks an email with an attachment titled “wk dnc link] .txt.gpg.” Search 
warrant returns for the Guccifer 2.0 Twitter account show that Guccifer 2.0 then sent a direct 
message to WikiLeaks that appears to explain that the encrypted file contained instructions on 
how to access an online archive of stolen DNC documents. On or about July 18, 2016, 
WikiLeaks confirmed it had “the 1Gb or so archive” and would make a release of the stolen 
documents “this week.” 

19. On or about July 22, 2016, WikiLeaks released over 20,000 emails and other 
documents stolen from the DNC network. This release occurred approximately three days before 
the start of the Democratic National Convention. WikiLeaks did not disclose Guccifer 2.0’s role 
in providing them. 

20. On or about October 7, 2016, WikiLeaks released the first set of emails that had 
been stolen from John Podesta, chairman of the Clinton Campaign. Between on or about 
October 7, 2016 and November 7, 2016, WikiLeaks released approximately thirty-three tranches 
of documents that had been stolen from Podesta. Based on an assessment of the WikiLeaks 
releases, investigators believe that the total amount of stolen election-related data released by 
WikiLeaks was substantially greater than the 1GB of stolen data apparently contained in the 


online archive provided by Guccifer 2.0, as described above. 
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21. In an August 2017 interview, ASSANGE indicated that only a small number of 
people, including himself, worked on the release of the DNC emails.* Based on public source 
information, I know that ASSANGE made false and misleading statements about the origins of 
the stolen documents, including statements that insinuated that WikiLeaks had received them 
from a recently-deceased DNC employee. 

22. Investigators have learned that WikiLeaks and/or ASSANGE communicated, 
including via intermediaries, about the stolen documents with Roger J. Stone (“STONE”), who 
advised the presidential campaign of Donald J. Trump in 2015 and who remained in contact with 
individuals employed by the campaign through the 2016 election. For example, search warrant 
returns for STONE’s Hotmail account i show that on or about July 25, 
2016, STONE directed one of his associates, Jerome CORSI, to “[g]et to Assange [a]t the 
Ecuadorian Embassy in London and get the pending WikiLeaks emails ....” On or about July 
31, 2016, Stone reached out again to CORSI, suggesting that he should “see Assange.” A few 
days later, on or about August 2, 2016, CORSI emailed STONE, “Word is friend in embassy 
plans 2 more dumps. One shortly after I’m back 2nd in Oct[ober]. Impact planned to be very 
damaging....” I believe that CORSI’s reference to a “friend in [the] embassy” refers to 
ASSANGE. 
€. The Target Account 


23. According to subscriber information obtained from WordPress in July 2016, the 


Guccifer 2.0 WordPress account ooo was created on June 15, 2016 using 
the email — oo and Target Accoun (iE 2s listed as 


3 See https://www.newyorker.com/magazine/2017/08/2 1 /julian-assange-a-man-without-a-country 
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another email address on the account. Subscriber records for the Target Account indicate that it 
was created on July 23, 2016 in the name of “Guccifer Second.” 

24. The FBI searched the Target Account in approximately August 2016 pursuant to 
a search warrant authorized by the Northern District of California. In approximately September 
2017, the government obtained additional non-content information about the Target Account 
pursuant to 18 U.S.C. § 2703(d), which included header information for the period of time 
between approximately August 2016 and September 2017. The header information shows that 
the Target Account continued to receive emails through at least approximately February 25, 
2017, including emails from WordPress and the file sharing services DropBox and MediaFire, 
which were not captured in the original court-authorized search conducted in August 2016. 

25. Subscriber records obtained from 1&1 Mail in August 2018 show that the Target 
Account is still active (that is, it has not been deleted). The last login is listed as October 18, 
2016. Records from the Target Account will, among other things, assist investigators in 
understanding Guccifer 2.0’s use of file sharing services, which may in turn assist investigators 
in identifying additional means by which Guccifer 2.0 shared stolen documents with WikiLeaks 
and others. 

BACKGROUND CONCERNING 1&1 MAIL 

26. In my training and experience, I have learned that 1&1 Mail provides a variety of 
on-line services, including electronic mail (“email”) access, to the public. 1&1 Mail allows 
subscribers to obtain email accounts at several domain names, including mail.com, like the Target 
Account. Subscribers obtain an account by registering with 1&1 Mail. During the registration 
process, 1&1 Mail asks subscribers to provide basic personal information. Therefore, the 


computers of 1&1 Mail are likely to contain stored electronic communications (including retrieved 


g- 
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and unretrieved email for 1&1 Mail subscribers and information concerning subscribers and their 
use of 1&1 Mail services, such as account access information, email transaction information, and 
account application information. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

27. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

28. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(i.e., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging into the account via the provider’s website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the Internet Protocol address 
(“IP address”) used to register the account and the IP addresses associated with particular logins 


to the account. Because every device that connects to the Internet must use an IP address, 
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IP address information can help to identify which computers or other devices were used to access 
the email account. 

29. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

30. This application seeks a warrant to search all responsive records and information 
under the control of 1&1 Mail, a provider subject to the jurisdiction of this court, regardless of 
where 1&1 Mail has chosen to store such information. The government intends to require the 
disclosure pursuant to the requested warrant of the contents of wire or electronic communications 
and any records or other information pertaining to the customers or subscribers if such 
communication, record, or other information is within 1&1 Mail’s possession, custody, or control, 
regardless of whether such communication, record, or other information is stored, held, or 
maintained outside the United States. 

31. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 


information stored in connection with an email account can indicate who has used or controlled 
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the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time (e.g., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g.,communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 

32. Because there is probable cause to believe that the Target Account is an 
operational account created to further criminal conduct, this application seeks authorization to 
seize the information in Attachment B from the time of the creation of the account to the present. 

FILTER REVIEW PROCEDURES 
33. Review of the items described in Attachment A and Attachment B will be 


conducted pursuant to established procedures designed to collect evidence in a manner consistent 


fo: 
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with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter team,” 
separate and apart from the investigative team, in order to address potential privileges. The 
government, however, does not at this time anticipate that any of the items described in 
Attachment A will contain materials requiring review by a designated filter team. 
CONCLUSION 

34. Based on the forgoing, I request that the Court issue the proposed search warrant. 

35. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

36. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this A Wy of August, 2018. 


Lo 


The Hongrable Rudolph Contreras 
United States District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following 1&1 Mail account, which 
is stored at premises owned, maintained, controlled, or operated by 1&1 Mail & Media, Inc., a 


company headquartered in Chesterbrook, Pennsylvania: 
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ATTACHMENT B 


I. Information to be disclosed by 1&1 Mail 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of 1&1 Mail & Media, Inc. (the “Provider”), including any messages, records, 


files, logs, or information that have been deleted but are still available to the Provider, or have 


been preserved pursuant to a request made under 18 U.S.C. § 2703(f), the Provider is required to 


disclose the following information to the government for each account listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

The types of service utilized; 

All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 


ae 
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& All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 


actions taken; 


É; All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All device information associated with the account, including all instrument or 


telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (““MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”’), or 
International Mobile Equipment Identities (““IMEI”)); and 

h For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 


source of payment (including any credit or bank account number). 
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I. Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 


U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud); 


and 52 U.S.C. § 30121 (foreign contribution ban), including: 


a. 


b. 


Evidence of unauthorized access to protected computers; 

Evidence of the distribution or transfer of data obtained through unauthorized 
access to protected computers; 

Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

Evidence indicating the account owner’s state of mind as it relates to the crimes 
under investigation; 

The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 


principals; 


«Az 
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h. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

i. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

j. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 


foreign government, foreign officials, foreign entities, foreign persons, or foreign 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Seon ss 
INFORMATION ASSOCIATED WITH ONE Case: 1:18-sc-02670 
ACCOUNT STORED AT PREMISES 
CONTROLLED BY 1&1 MAIL & MEDIA, 
INC. 


Assigned To : Howell, Beryl A. 

Assign. Date : 8/20/2018 

Description: Search & Seizure Warrant 
j 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non- 
disclosure, the proposed Order would direct 1&1 Mail & Media, Inc. (“1&1 Mail”), an electronic 
communication and/or remote computing services provider headquartered in Chesterbrook, 
Pennsylvania, not to notify any other person (except attorneys for 1&1 Mail for the purpose of 
receiving legal advice) of the existence or content of the Warrant for a period of one year or until 
further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 

l; The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 


the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 
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al In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
“district court of the United States . . . that — has jurisdiction over the offense being investigated.” 
18 U.S.C. § 2711(3)(A)G). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). 1&1 Mail provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how 1&1 Mail may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(1)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 
notification. In relevant part, Section 2705(b) provides as follows:! 

(b) Preclusion of notice to subject of governmental access. — A governmental 

entity acting under section 2703 . . . may apply to a court for an order commanding 


a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 


' Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 
(1) endangering the life or physical safety of an individual; 
(2) flight from prosecution; 
(3) destruction of or tampering with evidence; 
(4) intimidation of potential witnesses; or 
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 
requisite showing about potential consequences of notification: 
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 
In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 
rb Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command 1&1 Mail not to notify any other person (except attorneys for 1&1 Mail for the purpose 
of receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 
FACTS SUPPORTING SEALING AND NON-DISCLOSURE 
6. The Federal Bureau of Investigation (“FBI”) is investigating WikiLeaks and others 
for violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 
U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an 
unregistered foreign agent), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 


18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), 
3 
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and 22 U.S.C. § 611 et seq. (Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign 
contribution ban) (the “Subject Offenses”), in connection with efforts to compromise the networks 
of the Democratic National Convention (“DNC”), the Democratic Congressional Campaign 
Committee (“DCCC”), and the email accounts of U.S. persons involved in the 2016 presidential 
election, followed by the public release of stolen materials through various outlets. 

7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that 1&1 Mail and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for 1&1 Mail for the purpose of receiving 
legal advice) for a period of one year or until further order of the Court. Such an order is 
appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature 
of which is neither public nor known to the targets of the investigation, and its disclosure may alert 
these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant 
and related papers may also alert the targets to the scope of information known to the FBI. Once 
alerted to this information, potential targets would be immediately prompted to destroy or conceal 
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic communication and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 


longer needed, the Government will notify the Court and seek appropriate relief. 
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9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with 1&1 Mail, the United States is aware that, absent a 
court order under Section 2705(b) commanding 1&1 Mail not to notify anyone about a legal 
request, 1&1 Mail may, upon receipt of a warrant seeking the contents of electronically stored wire 
or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
1&1 Mail not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for 1&1 Mail for the purpose of receiving legal advice) for a period of one year 
or until further order of the Court. 

Respectfully submitted, 


ROBERT S. MUELLER, III 


Special or a. 


Dated: 8/20/18 By: 
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FILED 
AUG 2 0 2018 


Clerk, U.S, District & Bankruptcy 
IN THE UNITED STATES DISTRICT COURT Courts for the District of Columbia 


FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF ee, 
INFORMATION ASSOCIATED WITH ONE ae ee 5 
ACCOUNT STORED AT PREMISES Assigned To: Howell, Beryl A. 
CONTROLLED BY 1&1 MAIL & MEDIA, Assign. Date : 8/20/2018 

INC. Description: Search & Seizure Warrant 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require 1&1 Mail & Media, Inc. (“1&1 Mail”), an electronic communication and/or remote 
computing services provider headquartered in Chesterbrook, Pennsylvania, not to disclose the 
existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), 1&1 Mail and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for 1&1 Mail for the purpose of receiving legal advice) for a period of one year or until 


further order of the Court. 


AA a—— 
THE HONORABLE RUDOLPH CONTRERAS 
UNITED STATES DISTRICT JUDGE 


20/00 


Dat 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 


In the Matter of the Search of ) 
(Briefly describe the property to be searched ) Case: 121 8-sc-02671 
or identify the person by name and address) ) Assigned To: Howell Beryl A 
) 
) 


INFORMATION ASSOCIATED WITH Assign. Date : 8/20/2018 
ONE CELLULAR TELEPHONE NUMBER THAT IS Description: Search & Seizure Warrant 
STORED AT PREMISES CONTROLLED BY AT&T  ) 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Southern | District of Florida 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before August 31, 2018 (not to exceed 14 days) 
M in the daytime 6:00 a.m. to 10:00 p.m. C at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 

The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge ; 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) C until, the facts justifying, the later specific date of 


Judge 's signature 


Date and time issued: §/2o/2a y É ‘0 Sm Mb | aai 


Hon. Rudolph Contreras, U.S. District Judge 


Printed name and title 


City and state: Washington, DC 
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AO 93 (Rey. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 
Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 


This warrant applies to information associated with the cellular telephone assigned call 


T E Account”), that is stores at premises controlled by AT&T (“the 


Provider”), headquartered at 11760 US Highway 1, North Palm Beach, Florida. 
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ATTACHMENT B 


I, Information to be disclosed by Provider 


To the extent that the information described in Attachment A is within the possession, 


custody, or contro] of the Provider, including any information that has been deleted but is still 


available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C. 


§ 2703(f), the Provider is required to disclose to the government the following information 


pertaining to the Account listed in Attachment A for the time period June 14, 2016 through 


November 15, 2016: 


a. The following information about the customers or subscribers of the Account: 


i, 


ii. 


iii. 


vi. 


vii. 


viii. 


Names (including subscriber names, user names, and screen names); 


Addresses (including mailing addresses, residential addresses, business 
addresses, and e-mail addresses); 


Local and long distance telephone connection records; 


Records of session times and durations, and the temporarily assigned 
network addresses (such as Internet Protocol (“IP”) addresses) associated 
with those sessions; 


Length of service (including start date) and types of service utilized; 


Telephone or instrument numbers (including MAC addresses, Electronic 
Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifier (“MEID”); Mobile Identification Number 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (““MSISDN”); International 
Mobile Subscriber Identity Identifiers (“IMSI’), or International Mobile 
Equipment Identities (“IMEI”); 


Other subscriber numbers or identities (including the registration Internet 
Protocol (“IP”) address); and 


Means and source of payment for such service (including any credit card 
or bank account number) and billing records. 


ts 


Il. 
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b. All records and other information (not including the contents of communications) 
relating to wire and electronic communications sent or received by the Account, 
including: 

i. the date and time of the communication, the method of the 
communication, and the source and destination of the communication 
(such as the source and destination telephone numbers (call detail 
records), email addresses, and IP addresses); and 
ii. information regarding the cell tower and antenna face (also known as 
“sectors”) through which the communications were sent and received. 
Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A which 


consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and abetting), 


18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 


(conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a 


protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to 


commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 


14, 2016 to November 15, 2016. 


A 


Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 6 of 35 


AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT FILER 
for the AUG 2 9 2018 


District of Columbia Clerk, U.S. District & Bankruptcy 
Courts for the District of Columbia 

Case: 1:18-sc-02671 

Assigned To : Howell, Beryl A. 

Assign. Date : 8/20/2018 

Description: Search & Seizure Warrant 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH 
ONE CELLULAR TELEPHONE NUMBER STORED AT 
PREMISES CONTROLLED BY AT&T 


i 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 
located in the _ Southern District of Florida , there is now concealed (identify the 


person or describe the property to be seized): 
See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 


im evidence of a crime; 
O contraband, fruits of crime, or other items illegally possessed; 


O property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
52 U.S.C. § 30121 Foreign Contribution Ban 
18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 
The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 
O Delayed notice of days (give exact ending date if more than 30 days: _) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: Applicant ’s signature 
Kyle R. Freeny (ASC) Andrew Mitchell, Special Agent, FBI 
ais Printed name and title 


Sworn to before me and signed in my presence. 


Dates A [20/208 | Sepa l> aeea 


Judge's signature 


Hon. Rudolph Contreras, U.S. District Judge 


Printed name and title 


City and state: Washington, D.C. _ 
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FILED 


AUG 2 g 2018 
Clork, U.S. District & Bankruptcy 
IN THE UNITED STATES DISTRICT COURT Courts for the District of Columbia 
FOR THE DISTRICT OF COLUMBIA 

IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02671 
INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A. 
ONE CELLULAR TELEPHONE NUMBER Assign. Date : 8/20/2018 
ee bream amend el Description: Search & Seizure Warrant 


CONTROLLED BY AT&T 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Andrew Mitchell, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application for a search warrant under 18 
U.S.C. § 2703(d) and Federal Rule of Criminal Procedure 41 for information associated with a 
certain cellular telephone assigned call number ae (“Target Telephone”), which is 
stored at premises owned, maintained, controlled or operated by AT&T, a wireless telephone 
service provider headquartered in North Palm Beach, Florida. The information to be disclosed by 
AT&T and searched by the government is described in the following paragraphs and in 
Attachments A and B. 

Des Iam a Special Agent with the Federal Bureau of Investigation (FBI), and have been 
since 2011. As a Special Agent of the FBI, I have received training and experience in investigating 
criminal and national security matters. 

a. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and does 
not set forth all of my knowledge about this matter. 


4. Based on my training and experience and the facts as set forth in this affidavit; there 


ai 


Case 1:19-mc-00029-CRC Document 29-18 Filed 04/28/20 Page 8 of 35 


is probable cause to believe that violations of the following statutes have been committed or are 
being committed: 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. 
§ 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 1001 (false 
statements), 18 U.S.C. § 1030 (unauthorized access of a protected computer), 18 U.S.C. § 1343 
(wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 52 U.S.C. 
§ 30121(a)(1)(C) (foreign expenditure ban). There also is probable cause to search the information 
described in Attachment A for evidence of the Subject Offenses, further described in Attachment 
B. 
JURISDICTION 

S, This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Jd. §§ 2703(a), (b)(1)(A), & 
(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 2711(3)(A)G). The offense conduct included activities in Washington, D.C., as detailed below. 

6. When the Government obtains records under § 2703 pursuant to a search warrant, 
the Government is not required to notify the subscriber or any other person of the warrant, for such 
a period as the Court deems appropriate, where there is reason to believe that such notification will 
seriously jeopardize an investigation. 18 U.S.C. § 2705(b). 

PROBABLE CAUSE 

T The Special Counsel’s Office, with FBP s assistance, is investigating the Russian 
government’s efforts to interfere in the 2016 presidential election, as well as any links and/or 
coordination between the Russian government and individuals associated with the campaign of 


President Donald Trump (“Trump Campaign”). This includes investigating Roger Stone (STONE) 


ae 
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and others known and unknown, in connection with the hacking of email accounts associated with 
the Democratic National Committee (DNC), Democratic Congressional Campaign Committee 
(DCCC), and individuals involved in the presidential campaign of Hillary Clinton, as well as the 
subsequent dissemination of hacked materials via the persona Guccifer 2.0 and the organization 
WikiLeaks, among others. 

8. This application seeks cell-site location information for the Target Telephone, 
used by STONE, between June 14, 2016 and November 15, 2016. As set forth below, this 
corresponds to the time period during which there is evidence that STONE was engaged in, and 
attempting to engage in, communications, directly or indirectly, with WikiLeaks and its founder 
Julian ASSANGE about the content of stolen documents prior to their public release. During this 
same time period, STONE was also in communications with members of the Trump Campaign. 

A. Background on Relevant Individuals 
i. Roger STONE 

9. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official relationship 
with the Campaign thereafter, STONE maintained his support for Trump and continued to make 
media appearances in support of the Campaign. As described further below, STONE also 
maintained contact with individuals employed by the Campaign, including then-campaign 
chairman Paul MANAFORT and deputy chairman Rick GATES. 

ii. Jerome CORSI 
10. Jerome CORSI is a political commentator who, according to publicly available 


information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According to 


Ba 
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publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” for 
the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of books 
regarding Democratic presidential candidates. As described further below, CORSI was in contact 
with STONE during the summer and fall of 2016 regarding forthcoming disclosures of hacked 


information by WikiLeaks, and appears to have obtained information regarding upcoming 


disclosures which he relayed to STONE. 


B. Russian Government-Backed Hacking Activity During the 2016 Presidential Election 
12. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 


“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 


gie 
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assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian Government 
developed a clear preference for President-elect Trump. 

T3: In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. Fhe USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

14. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[iJn July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks and 
maintained that access until at least June 2016.” The USIC attributed these cyber activities to the 
Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted in the 
compromise of the personal e-mail accounts of Democratic Party officials and political figures. By 
Niak the GRU had exfiltrated large volumes of data from the DNC.” 

15. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release 
US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

16.  Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 


contradictory statements and false claims about his identity throughout the election. 


17. The Special Counsel’s Office has determined that individuals associated with the 
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GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

18. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals used 
three new accounts with the same cloud computing service to move the “snapshots” to those 
accounts. 

19. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. | 

20. On or about November 1, 2016, individuals associated with the GRU spearphished 
over 100 accounts used by organizations and personnel involved in administering elections in 
numerous Florida counties. 

21. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 

C. Evidence of Google Searches Relating to the Conduct Under Investigation 

22. During the course of its investigation, the FBI has identified a series of searches 
that appear to relate to the persona Guccifer 2.0, which predate the public unveiling of that persona. 
In particular, on or about June 15, 2016 (prior to the publication of the Guccifer 2.0 WordPress 


blog), records from Google show that searches were conducted for the terms “guccifer” and 
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“ouccifer june,” from an IP address within the range 107.77.216.0/24.' This IP range is assigned 
to AT&T Mobility LLC, and, according to Google, the searches were all conducted from Florida. 

23. IP logs obtained from Twitter show that STONE used multiple IP addresses within 
the range 107.77.216.0/24 to log into his Twitter account @RogerJStoneJr. 

24. Pursuant to a search warrant issued by Chief Judge Beryl A. Howell on or about 
June 13, 2018, the FBI obtained all searches conducted by the CookieIDs that conducted the 
Guccifer-related searches described above.? Based on these results, the FBI has not yet been able 
to attribute the searches to any particular user. 

D. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

25. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated on 
its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part of 
the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” In 
that post, Guccifer 2.0 also began releasing hacked DNC documents. 

26. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 


27. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 


' Google does not retain full IP addresses for searches conducted more than one year ago. The 
truncated IP addresses designated here as 107.77.216.0/24 and 17.56.26.0/24 each encompass a 
range of up to 256 IP addresses. 


Google assigns unique CookieIDs to searches conducted while a user is not logged into a Google 
account. All searches conducted from the same device and browser during a 24-hour window are 
associated with the same CookieID. 


a 
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Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the RER 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

28. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With regard 
to the October surprise, what would be your forecast on that given what Julian Assange has 
intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain to 
the Clinton Foundation but there’s no telling what the October surprise may be.” A few days later, 
STONE clarified that while he was not personally in touch with ASSANGE, he had a close friend 
who served as an intermediary. 

29. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

30. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, Guccifer 


2.0’s Twitter account was reinstated. 
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al On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say u r 
great man. please tell me if J can help u anyhow. it would be a great pleasure to me.” 

32. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

33. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I believe 
that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the Clinton 
aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

34. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

35. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

36. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 


tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
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of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr to 
tweet: “Payload coming. #Lockthemup.” 

37. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

38. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link to 
approximately 2,050 emails that had been hacked from J ohn Podesta’s personal email account. 

39. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. I 
do believe he has all of the e-mails that Huma Abedin and Chery! Mills, the Clinton aides, thought 
were deleted. I hear that through my emissary.” 


40. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing from 


AG 
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an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

E. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

41. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks.? The latter account is the official Twitter account of WikiLeaks and has been 
described as such by numerous news reports. The message read: “Since I was all over national 
TV, cable and print defending WikiLeaks and assange against the claim that you are Russian agents 
and debunking the false charges of sexual assault as trumped up bs you may want to rexamine the 
strategy of attacking me- cordially R.” 

42. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

43. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your operation 
leaks like a sieve. You need to figure out who your friends are.” 


44, On or about November 9, 2016, one day after the presidential election, @wikileaks 


3 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the Twitter 
account @RogerJStoneJr. 


Ts 
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sent a direct message to @RogerJStoneJr containing a single word: “Happy?” @wikileaks 
immediately followed up with another message less than a minute later: “We are now more free 
to communicate.” 

45. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, the 
founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: “Still 
nonsense. As a journalist it doesn’t matter where you get information only that it is accurate and 
authentic. The New York Times printed the Pentagon Papers which were indisputably stolen from 
the government and the courts ruled it was legal to do so and refused to issue an order restraining 
the paper from publishing additional articles. If the US government moves on you I will bring 
down the entire house of cards. With the trumped-up sexual assault charges dropped I don’t know 
of any crime you need to be pardoned for - best regards. R.” That same day, @JulianAssange 
responded: “Between CIA and DoJ they’re doing quite a lot. On the DoJ side that’s coming most 
strongly from those obsessed with taking down Trump trying to squeeze us into a deal.” 

46. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest level 
of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in this 


forum as experience demonstrates it is monitored. Best regards R.” 


F. CORSI’s Communications with stone, i and Others Regarding 


Forthcoming Leaks 


47. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE GO rr 


2017, Chief Judge Howell issued a search warrant for one of STONE’ sf KS 


oe On or about December 19, 2017, Chief Judge Howell issued a search 


Ae. 


On October 17, 
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warrant “o email account. On or about March 14, 2018, Chief Judge Howell issued 


a search warrant for STONE’s iCloud account. Information recovered pursuant to those search 


warrants indicated the following: 


48. On or about May 15, 206, emailed CORSI: “Here is my flight 


schedule. Need to get something confirmed now... .” CORSI responded, “I copied Roger Stone 


so he knows your availability to meet Manafort and DT this coming week.” CORSI appears to 


have forwarded the message to STONE i who replied to CORSI that, 


“May meet Manafort -guarantee nothing.” 


49. On or about May 18, 2016, CORSI emailed STONE hit 


I believe that 


with the title, “Roger -- why don't you look this over before I send i 


and I did manage to see Mr. Trump for a few minutes today as we were 

waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

50. On July 25, 2016, STONE, in i sent an email to CORSI 
with the subject line, “Get to Assange.” The body of the message read: “Get to Assange [a]t 
Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

Sh On or about July 31, 2016, STONE, using EN] emaile 
CORSI with the subject line, “Call me MON.” The body of the email read should see 
Assange[.] Bo: find Bernie [S]anders brother who called Bill a Rapist — turn him for 


Trump[.] zz find pe more proof of Bill getting kicked out.” 


On or about August 2, 2016 (approximately 19 days before STONE publicly 


fs 
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tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 
P| “Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox will 
have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, for now. 
Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential campaign 
to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to be exposed 
as in bed w enemy if they are not ready to drop HRC. That appears to be the game hackers are 
now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- neither he nor 
she well. I expect that much of next dump focus, setting stage for Foundation debacle.” 
Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 more dumps” 


refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


53. On or about August 4, 20, an associate of STONE’s, emailed 
STONE ‘i The email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded on or about the same day, “enjoy it while u can[.] I 


dined with my new pal Julian Assange last night.” Eo subsequently stated to investigators 


that, around the same time, STONE told him he had gone to London to meet ASSANGE. 


a also stated that in 201 5 ë 31 STONE he would be interviewed by the FBI 


and would have to divulge the conversation about meeting ASSANGE. STONE cold 


he was joking and had not actually met ASSANGE.* 
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54. | Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email ` g have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this afternoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
call later — heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

55; On or about August 15, 2016, CORSI emailed STONE yr | 
“Give me a call today if you can. Despite MSM drumroll that HRC is already elected, it’s not over 
yet. More to come than anyone realizes. Won’t really get started until after Labor Day. I’m in NYC 
this week. Jerry.” 

56. On or about August 31, 2016, CORSI emailed STONE FU 
“Did you get the PODESTA writeup.” STONE replied “[y]es.” 

57. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by S[b]Jerbank, 
Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton false narrative 
attempting to tie Trump to Putin.” 


58. On or about September 6, 2016, CORSI emailed STONE at 


ae “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 


59; On or about September 24, 2016, | RS CORSI, “I will have much 


al Se 
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more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have secure 

back channel through Roger. I saw him again in NYC last Friday and spoke to him about it again 

oday.” EE vote back, “Awaiting secret file. Explosive... Hope you are well. Can't wait 

for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted about filef.]” 
In a subsequent meeting with investigators, indicated this conversation concerned 
possible derogatory information he was trying to obtain from Turkey. 

60. On or about October 3, 2016, an associate of STONE emailed STONE at 

Oo asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve BANNON, 
who was CEO of the Campaign at the time, and wrote: “You should call Roger. See below. You 
didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry about.” The 
associate responded, “Well clearly he knows what Assange has. I’d say that’s important.” 

6l. On or about October 4, 2016, ASSANGE gave a press conference at the Ecuadorian 
Embassy. There had been speculation in the press leading up to that event that ASSANGE would 
release information damaging to then-candidate Clinton, but WikiLeaks did not make any new 
releases. Instead, ASSANGE promised more documents, including information “affecting three 
powerful organizations in three different states, as well as, of course, information previously 
referred to about the U.S. election process.” ASSANGE also stated that WikiLeaks would publish 
documents on various subjects every week for the next ten weeks, and vowed that the U.S. 
election-related documents would all come out before Election Day. 

62. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 


“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 


To- 
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63. That same day, BANNON emailed STONE 7 “What was 


that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t cut 
deal w/ clintons???” STONE replied, “Don't think so BUT his wy: a big democrat.” 

64. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE was 
about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking STONE 
about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and BANNON 
had been hoping for releases of damaging information that morning. 


G. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released 


65. According to a publicly available news article,° at approximately 11AM on Friday, 
October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from a source 
regarding a previously unaired video of candidate Trump. According to the same article, 
“Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage from a 2005 
segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, calling Trump’s 
campaign, ‘Access Hollywood,’ and NBC for reaction.” 

66. According to phone — o g approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

67. At approximately 11:53AM, STONE received a phone call from the Washington 


Post. The call lasted approximately twenty minutes. 


> https:/Awww.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 1d74714-8ce5-11e6-875e-2¢ 1 bfe943b66_story.html 


ate. 
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68. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

69. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

70. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

Pk. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails hacked 
from John Podesta that focused primarily on materials related to the Clinton Foundation. On or 


about August 2, 2016, CORSI emailed STONE vin iii = “I expect that 


much of next dump focus, setting stage for Foundation debacle.” 
A2: At approximately 6:27PM, e an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 
S ----- BE <ss2cc to CORSI without comment. STONE does 
not appear to have forwarded the email to any other individual. 


H. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


Ts On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed — have 
to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty minutes 
later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T attacking 
Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job numbers.” 


74. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 


vine emailed Corsi asking him to “send me your best podesta links.” 
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STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on Podesta 
is complicated. Two articles in length. I can give you in raw form the stuff I got in Russian 
translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

75. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at il with the subject line 
“Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE podesta 
talking points Oct 12 2016.docx.” The “talking points” included the statement that “Podesta is at 
the heart of a Russian-government money laundering operation that benefits financially Podesta 
personally and the Clintons through the Clinton Foundation.” 

76. CORSI followed up several minutes later with another email titled, “Podesta talking 
points,” with the text “sent a second time just to be sure you got it.” STONE emailed CORSI back 
via the Hotmail Account, “Got them and used them.” 

TT. On or about Thursday, October 13, 2016, CORSI emailed STONE at 

Le “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could post 
under my by-line since I am the one under attack by Podesta and now Mook.” CORSI wrote back 
to STONE, “PIH give you one more — NOBODY YET HAS THIS[:] It looks to me like 
er skimmed maybe billions off Skolkovo — Skolkovo kept their money with 


Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once o K 


the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s Clinton 


Fund account, there’s no telling how much money he laundered, or where it ended up. Nothing in 


li. 
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Clinton Foundation audited financials or IRS Form 990s about $$$ received via Russia & 
Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me SOMETHING to 
post on Podesta since I have now promised it to a dozen MSM reportersf.]|” 

78. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email at OO the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own name.” 
That same day, STONE posted a blog post with the title, “Russian Mafia money laundering, the 
Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I have had some 
back-channel communications with Wikileaks I had no advance notice about the hacking of Mr. 
Podesta nor I have I ever received documents or data from Wikileaks.” The post then asked, “Just 
how much money woo f controversial Russian billionaire investor with ties to 
the Vladimir Putin and the Russian government, launder through Metcombank, a Russian regional 
bank owned 99.978 percent go o with the money transferred via Deutsche Bank and 
Trust Company Americas in New York City, with the money ending up in a private bank account 
in the Bank of America that is operated by the Clinton Foundation?” 

79. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s basically 
a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

80. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just landed 
JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important intel to 


share.” 
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8l. On or about October 17, 2016, CORSI emailed STONE yr | 
ae with the subject, “Fwd: ASSANGE...URGENT...” CORSI wrote, 


“From a very trusted source,” and forwarded an email with the header information stripped out, 
showing only the body text. The email read, “Yes[.] I figured this. Assange is threatening Kerry, 
Ecuador and U.K. He will drop the goods on them if they move to extradite him. My guess is that 
he has a set of dead man files that include Hillary. It’s what they used to call a ‘Mexican stand 
off[.]’ Only hope is that if Trump speaks out to save him[.] Otherwise he’s dead anyway, once he’s 
dropped what he has. If HRC wins, Assange can kiss his life away. Interesting gambit Assange 
has to play out. He’s called Podesta’s bluff and raised him the election.” 

82. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pls call. Important.” 

83. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” STONE 
stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear it from 
Wikileaks, although Julian Assange and I share a common friend. I reported the story on my 
website.” STONE linked to the story he had asked CORSI to write for him on October 13, 2016 
discussed above. 

84. On or about November 8, 2016, the United States presidential election took place. 

85. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 

86. On or about November 10, 2016, CORSI messaged STONE at his iCloud account, 
“Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in London. 


Have some interesting news for you.” 


Hs 
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I. The Target Telephone 
87. Search warrant returns for STONE’s Hotmail TA o 

show that on numerous occasions, including in 2016, STONE provided the Target Telephone 
Number to individuals as his cellular telephone number and/or the way to reach him. On or about 
August 17, 2017, a indicated that the “user” of the 
Target Telephone Number is “Roger J. Stone.” Publicly available databases indicate the Target 
Telephone Number is currently assigned to AT&T wireless and registered to Drake Ventures, a 
company investigators have linked to STONE. 


88. There is evidence that STONE used the Target Phone in connection with the 


conduct under investigation. For example, according to records o E 
= 
a) STONE called CORSI on or about July 25, 2016 from the Target Phone, and spoke 
with him for approximately twenty-six minutes. Less than roughly two hours after that call, 
STONE emailed CORSI, “Get to Assange [a]t the Ecuadorian Embassy in London and get the 
pending wikileaks emails... .” 
b) On or about July 30, 2016—one day before STONE instructed CORSI to have 
Sa contact ASSANGE—Manafort, who was then-Chairman of the Trump Campaign, 
called STONE on the Target Phone Number. The two spoke for approximately sixty-seven 
minutes. 
c) On or about October 7, 2016, on the day of the Access Hollywood video disclosure, 
STONE received a call from the Washington Post at the Target Phone Number, and shortly 


thereafter, STONE had two conversations with CORSI from the Target Phone Number. 


89. As set forth in Attachment B, this application seeks cell-site location information 


-22- 
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for the Target Telephone between June 14, 2016—the day before a Google search was conducted 
for several Guccifer-related terms from a Florida IP address, followed by Guccifer 2.0’s first public 


appearance—and November 15, 2016—one week after the 2016 presidential election and less than 


one week after CORSI messaged STONE about having “interesting news” for him. Given 
STONE’s repeated communications with and/or about the WikiLeaks releases during this time, 
including discussions about the content of the documents prior to their release, there is probable 
cause to believe that STONE’s whereabouts during this time period will yield evidence of the 
Subject Offenses under investigation. Location information for the Target Phone will assist 
investigators in determining, among other things: whether STONE was in Florida at the time of 
the Guccifer-related searches; whether STONE met with members of the Trump Campaign at or 
around any of the events or communications discussed above; and where STONE was on the night 
he claimed he “dined” with ASSANGE.® Location information will also assist investigators in 
identifying meetings between STONE and any intermediaries to WikiLeaks and/or other potential 
co-conspirators during this time period. 
BACKGROUND CONCERNING AT&T 

90. Inmy training and experience, I have learned that AT&T is a company that provides 
cellular telephone access to the general public. I also know that providers of cellular telephone 
service have technical capabilities that allow them to collect and generate information about the 


locations of the cellular telephones to which they provide service, including cell-site data, also 


6 As noted above, investigators believe that STONE was in Los Angeles at the time he claimed to 
have met ASSANGE, but the FBI is investigating whether STONE may have met an intermediary 
instead, or otherwise made contact with WikiLeaks. As explained below, the precision of cell-site 
location information varies depending on the distance between towers (among other things). 
Given the density of Los Angeles, I believe that cell-site location data for STONE’s trip there 
would assist investigators in determining, among other things, whether STONE was present at the 
locations he has publicly claimed to have been. 


ce 
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known as “tower/face information” or “cell tower/sector records.” Cell-site data identifies the 
“cell towers” (i.e., antenna towers covering specific geographic areas) that received a radio signal 
from the cellular telephone and, in some cases, the “sector” (i.e., faces of the towers) to which the 
telephone connected. These towers are often a half-mile or more apart, even in urban areas, and 
can be 10 or more miles apart in rural areas. Furthermore, the tower closest to a wireless device 
does not necessarily serve every call made to or from that device. Accordingly, cell-site data 
provides an approximate location of the cellular telephone but is typically less precise than other 
types of location information, such as E-911 Phase II data or Global Positioning Device (“GPS”) 
data. 

91. Based on my training and experience, I know that AT&T can collect cell-site data 
about the Target Telephone. Cell-site location data is typically generated only when the phone 
is used to engage in communications. I also know that wireless providers such as AT&T typically 
collect and retain cell-site data pertaining to cellular phones to which they provide service in their 
normal course of business in order to use this information for various business-related purposes. 

92. Based on my training and experience, I know that wireless providers such as 
AT&T typically collect and retain information about their subscribers in their normal course of 
business. This information can include basic personal information about the subscriber, such as 
name and address, and the method(s) of payment (such as credit card account number) provided 
by the subscriber to pay for wireless telephone service. I also know that wireless providers such 
as AT&T typically collect and retain information about their subscribers’ use of the wireless 
service, such as records about calls or other communications sent or received by a particular 
phone and other transactional records, in their normal course of business. In my training and 


experience, this information may constitute evidence of the crimes under investigation because 


JA- 
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the information can be used to identify the Target Telephone user or users and may assist in the 
identification of co-conspirators and/or victims 
FILTER REVIEW PROCEDURES 

93. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter team,” 
separate and apart from the investigative team, in order to address potential privileges. The 
government, however, does not at this time anticipate that any of the items described in 
Attachment A will contain materials requiring review by a designated filter team. 

CONCLUSION 
94. Based on the forgoing, I request that the Court issue the proposed search warrant. 
95. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 


required for the service or execution of this warrant. 


95 
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REQUEST FOR SEALING 


96. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Andrew Mitchell 

Special Agent 

Federal Bureau of Investigation 
Subscribed and sworn to before me on this 20 day of August, 2018. 


Jof t 


The Honoráble Rudolph Contreras 
United States District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the cellular telephone assigned call 


number = KE Account”), that is stores at premises controlled by AT&T (“the 


Provider”), headquartered at 11760 US Highway 1, North Palm Beach, Florida. 
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ATTACHMENT B 


I. Information to be disclosed by Provider 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of the Provider, including any information that has been deleted but is still 


available to the Provider or that has been preserved pursuant to a request made under 18 U.S.C. 


§ 2703(f), the Provider is required to disclose to the government the following information 


pertaining to the Account listed in Attachment A for the time period June 14, 2016 through 


November 15, 2016: 


a. The following information about the customers or subscribers of the Account: 


i 


mis 


ill. 


vi. 


Vii. 


viii. 


i 


Names (including subscriber names, user names, and screen names); 


Addresses (including mailing addresses, residential addresses, business 
addresses, and e-mail addresses); 


Local and long distance telephone connection records; 


Records of session times and durations, and the temporarily assigned 
network addresses (such as Internet Protocol (“IP”) addresses) associated 
with those sessions; 


Length of service (including start date) and types of service utilized; 


Telephone or instrument numbers (including MAC addresses, Electronic 
Serial Numbers (“ESN”), Mobile Electronic Identity Numbers (“MEIN”), 
Mobile Equipment Identifier (“MEID”), Mobile Identification Number 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”); International 
Mobile Subscriber Identity Identifiers (‘IMST’), or International Mobile 
Equipment Identities (“IMET”); 


Other subscriber numbers or identities (including the registration Internet 
Protocol (“IP”) address); and 


Means and source of payment for such service (including any credit card 
or bank account number) and billing records. 


Ez 
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b. All records and other information (not including the contents of communications) 
relating to wire and electronic communications sent or received by the Account, 
including: 

i. the date and time of the communication, the method of the 
communication, and the source and destination of the communication 
(such as the source and destination telephone numbers (call detail 
records), email addresses, and IP addresses); and 
ii. information regarding the cell tower and antenna face (also known as 
“sectors”) through which the communications were sent and received. 
II. Information to be Seized by the Government 
Any and all records that relate in any way to the accounts described in Attachment A which 
consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and abetting), 
18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 U.S.C. § 371 
(conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a 
protected computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to 
commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the period from June 


14, 2016 to November 15, 2016. 


iia 
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AO 93 (Rey. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 

In the Matter of the Search of ) | 

(Briefly describe the property to be searched ) Case: 1:18-sc-02727 
or identify the person by name and address) ) Assigned To : Chief Judge Beryl A. Howell 
INFORMATION ASSOCIATED WITH ONE ACCOUNT ) Assign. Date : 8/28/2018 | 
STORED AT PREMISES ) Description: Search and Seizure Warrant 
CONTROLLED BY FACEBOOK ) | 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before September 11, 2018 (not to exceed 14 days) 
A in the daytime 6:00 a.m. to 10:00 p.m. Ù at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. James E. Boasberg, U.S. District Judge 
(United States Magistrate Judge) 


[1 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box), 

O for _ days (not to exceed 30) O until, the facts justifying, the later specific date of 


Date and time issued: g / 1$) g EK 5 j pon 
City and state: Washington, DC Hon. J . Boasberg, U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the Facebook accounts registered to 
the following email addresses, stored at premises owned, maintained, controlled, or operated by 


Facebook, Inc. (“Facebook”), a company headquartered in Menlo Park, California: 


la i 


ie 
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ATTACHMENT B 
I. Information to be disclosed by Facebook 
To the extent that the information described in Attachment A is within the possession, 
custody, or control of Facebook, Inc. (“Facebook”), including any messages, records, files, logs, 
or information that have been deleted but are still available to Facebook, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the 
following information to the government for each account listed in Attachment A: 
(a) All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, — 
and other personal identifiers. 
(b) All activity logs for the account and all other documents showing the user’s posts 
and other Facebook activities; 
(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 
(d) All profile information; News Feed information; status updates; videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including 
the friends’ Facebook user identification numbers; groups and networks of which 
the user is a member, including the groups’ Facebook group identification numbers; 
future and past event postings; rejected “Friend” requests; comments; gifts; pokes; 


tags; and information about the user’s access and use of Facebook applications; 
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(e) All other records of communications and messages made or received by the user, 
including all private messages, chat history, video calling history, and pending 
“Friend” requests; 

(69) All records relating to machine cookies; 

(g) All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

(hb) AIL IP logs, including all records of the IP addresses that logged into the account; 
(i) All records of the account’s usage of the “Like” feature, including all Facebook 
posts and all non-Facebook webpages and content that the user has “liked”; 

(Gj) All information about the Facebook pages that the account is or was a “fan” of; 

(k) All past and present lists of friends created by the account; 

(1) All records of Facebook searches performed by the account; 

(m) All information about the user’s access and use of Facebook Marketplace; 

(n) The types of service utilized by the user; 

(0) The length of service (including start date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

p) Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
information for the creator and/or administrator of the group and a PDF of the 
current status of the group profile page; 

(q) All past and present Admins for the group; 


(r) The “Creator” of the group; 
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(s) 


(t) 


u) 


All privacy settings and other account settings, including privacy settings for 
individual Facebook posts and activities, and all records showing which Facebook 
users have been blocked by the account; 

All records pertaining to communications between Facebook and any person 
regarding the user or the user’s Facebook account, including a with support 
services and records of actions taken; 

All records related to advertisements and advertising conducted through the 
accounts, including advertisements purchased, advertising parameters (search 


terms, groups, geographic areas) selected and queried. 


Il. Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2015 to the present, including: 


a. 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 


or other obfuscation about knowledge of, or access to, hacked material; 


a4. 
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b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, 

Assange, Randy Credico, or any 
individual associated with the Trump Campaign; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign TERET foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 


the geographic and chronological context of account access, use, and events relating 


to the crimes under investigation and to the account owner; 


h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 
i. The identity of the person(s} who created or used the account, including records 


that help reveal the whereabouts of such person(s); 


Sm 
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j. 


Credit card and other financial information, including but not limited to, bills and 

payment records evidencing ownership of the subject account; 

All images, messages and communications regarding wiping software, encryption 

or other methods to avoid detection by law enforcement; 

The identity of any non-U.S. person(s)—including records that help reveal the 
` 

whereabouts of the person(s)}—-who made any expenditure, independent 

expenditure, or disbursement for an electioneering communication; and 

The identity of any person(s)—including records that help reveal the whereabouts 

of the person(s)}—who communicated with the account about any matters relating 

to activities conducted by on behalf of, for the benefit of, or at the direction of any 

foreign government, foreign officials, foreign entities, foreign persons, or foreign 

principals. 

Passwords and encryption keys, and other access information that may be necessary 

to access the account and other associated accounts; 

All existing printouts from original storage which concern the categories identified 


in subsection II.a. 


26s 
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AUG 2 3 2018 
IN THE UNITED STATES DISTRICT COURT : 
FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District & Bankruptey 


Courts for the Distriet of Cohnnhia 
IN THE MATTER OF THE SEARCH OF Case: 1:18" sc-02727 
INFORMATION ASSOCIATED WITH ONE Assigned To : Chief Judge Beryl A. Howell 
ACCOUNT STORED AT PREMISES Assign. Date : 8/28/2018 
- CONTROLLED BY FACEBOOK . Description: Search and Seizure Warrant 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, fnghiding the application and affidavit in support thereof (collectively the “Warrant”), | 
and to require Facebook, Inc. (“Facebook”), an electronic communication and/or remote 
computing services provider headquartered in Menlo Park, California, not to disclose the existence 
or contents of the Warrant pursuant to 18 U.S.C. § 2705(6). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Facebook and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Facebook for the purpose of receiving legal advice) for a period of one year or until 


further order of the Court. 


Date 
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UNITED STATES DISTRICT COURT 
for the AUG 2 8 2018 


District of Columbia Clerk, U.S. District & Bankruptey 
Courts for the District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED 
BY FACEBOOK 


Case: 1:18-sc-02727 

Assigned To : Chief Judge BerylA. Howell 
Assign. Date : 8/28/2018 

Description: Search and Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 
located in the Northern _ District of California __ , there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
Mf evidence of a crime; 
Í contraband, fruits of crime, or other items illegally possessed, 
property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
52 U.S.C. § 30121 Foreign Contribution Ban 
18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 
The application is based on these facts: 
See attached Affidavit. 


z4 Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


ae ee 


Reviewed by AUSA/ SAUSA: Applicant's signature 
Kyle R. Freeny (ASC) Curtis Heide, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


Date: A [28/ /6 Ci 


J dge s sian ire 


City and state: Washington, D.C. Hon. Jåmeşs E. Boasberg, U.S. District Judge 


Printed name and title 


Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 12 of 56 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02727 


INFORMATION ASSOCIATED WITH ONE Assigned To : Chief Judge Beryl A. Howell 
ACCOUNT STORED AT PREMISES Assign. Date : 8/28/2018 
CONTROLLED BY FACEBOOK Description: Search and Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b) 


The United States of America, moving by and isig its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. §2705(b). In regard to the non- 
disclosure, the proposed Order would direct Facebook, Inc. (“Facebook”), an electronic 
communication and/or remote computing services provider headquartered in Menlo Park, 
California, not to notify any other person (except attorneys for Facebook for the purpose of 
receiving legal advice) of the existence or content of the Warrant for a period of one year or until 
further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 

1, The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a 


court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
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(1) endangering the life or physical safety of an individual; 
(2) flight from prosecution; 
(3) destruction of or tampering with evidence; 
(4) intimidation of potential witnesses; or 
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 
requisite showing about potential consequences of notification: 
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 


government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 


In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(6) for Grand Jury 
Subpoena #GJ201403 1422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Facebook not to notify any other person (except attorneys for Facebook for the purpose 
of receiving legal advice) of the existence of the Subsea for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 USC. 
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a 
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent), 
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 et seq. 
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject 


Offenses”), in connection with efforts to compromise the networks of the Democratic National 
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to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Facebook, the United States is aware that, absent a 
court order under Section 2705(b) commanding Facebook not to notify anyone about a legal 
request, TET may, upon receipt of a warrant seeking the contents of electronically stored wire 
or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Facebook not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for Facebook for the purpose of receiving legal advice) for a period of one year 
or until further order of the Court 

Respectfully submitted, 


ROBERT S$. MUELLER, III 


Special ae, 


Dated: 6/2@/A¢> By: 


(202) 616-3812 
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AUG 2.8 2018 
IN THE UNITED STATES DISTRICT COURT  Glerk, U.S. District & Bankruptcy 


FOR THE DISTRICT OF COLUMBIA Courts for the District of Columbia 
IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02727 
INFORMATION ASSOCIATED WITH ' Assigned To : Chief Judge Beryl A. Howell 
ONE ACCOUNT STORED AT PREMISES Assign. Date : 8/28/2018 
CONTROLLED BY FACEBOOK Description: Search and Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Curtis Heide, being first duly sworn, hereby depose and state as follows: 


INTRODUCTION AND AGENT BACKGROUND 

l. I make this affidavit in support of an application for a search warrant for 
information associated with the Facebook account registered to N 
(“Target Account”), stored at premises owned, maintained, controlled or operated by Facebook, 
Inc. (“Facebook”), a company headquartered in Menlo Park, California. The information to be 
disclosed by Facebook and searched by the government is described in the following paragraphs 
and in Attachments A and B. 

2; I have been a Special Agent with the Federal Bureau of investigation for 12 years. 
In the course of my duties, I have been responsible for investigating federal crimes and national 

security matters involving both counterintelligence and issues related to. cybersecurity. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contain evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
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abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 
JURISDICTION 

5; This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 
(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 271 IOAN. The offense conduct included activities in Washington, D.C., as detailed below. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 


continued to make media appearances in support of the Campaign. As described further below, 


| 
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STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii, Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election l 


9, On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
- assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Govemiient agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

li. With iaa to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “{i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) neewoue 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 


in the compromise of the personal e-mail accounts of Democratic Party officials and political 


figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 
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12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC aiii housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an Adean 


against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
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presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 
C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded bile available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you'll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22.. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 


ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
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aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
sictaally have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

26. On August 18,2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that suik 


day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
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[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 

form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 

Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 

believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 

Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 
28. On September 16, 2016, STONE said in a radio interview with Boston Herald 


Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 


basis fairly soon. And that of course will answer the question as to what exactly what was erased . 


on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration - STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 


“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 


to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 
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33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” | 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 
35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 


Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 


205 


Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 24 of 56 


account @wikileaks.' The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” | 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged. 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: | 
“Still nonsense. As a journalist it doesn’t matter where Ji get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 


indisputably stolen from the government and the courts ruled it was legal to do so and refused to 


l On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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| 


issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 


- DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 


squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with STONE, and Others Regarding 
Forthcoming Leaks 


41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE’s RER O October 


17, 2017, Chief Judge Howell issued a search warrant for one of STONE sf addresses, 
——— On or about December 19, 2017, Chief Judge Howell issued a search 

warrant ~o A account. On or about March 14, 2018, Chief Judge Howell 

issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 


search warrants indicated the following: 


42. Onor about May 15, 2016, BE O CORSI: “Here is my flight 
schedule. Need to get something confirmed now... .” CORSI responded, “I copied Roger 


Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 


appears to have forwarded the message to STONE at Oo A replied to 


CORSI that, “May meet Manafort -guarantee nothing.” 
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43. Onor about May 18, 2016, CORSI emailed STONE at fii 
with the title, “Roger -- why don't you look this over before I send it | I believe that 
a o: o 
Oo I did manage to see Mr. Trump for a few minutes today as we were 


waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

44. On July 25, 2016, STONE, using 0 GR an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails. ..they deal with 
Foundation, allegedly.” 

45. Onor about July 31, 2016, STONE, vin emailed 
CORSI with the subject line, “Call me MON.”: The body of the email read: . o should see 
Assange[.] BE sou find Bernie [Slanders brother who called Bill a Rapist — turn him for 
Trump[.] a should find a. more proof of Bill getting kicked out.” | 

46. Onor about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

O=O DQ is friend in embassy plans 2 more dumps. One shortly after Pm 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC R for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 


hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- 
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neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 
47. On or about August 5, 2 an associate of STONE’s, emailed 


STONE at iE rhe email contained a tink to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u canf.] I dined with my new pal 
Julian Assange Hast night.” E. -i stated to investigators that, around the 
same time, STONE told him he had gone to London to meet AS Wea M stated 
that in 201 7 Q STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE w E was joking and 
had not actually met ASSANGE.? 

| 48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email So have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this afternoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
call later — heading for airport now[.]” Additionally, investigators have identified a photograph in 


STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
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information indicating that it was taken in Los Angeles. 
49. Onor about August 15, 2016, CORSI emailed STONE at 
—— “Give me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really st started 
until after Labor Day. I’m in NYC this week. Jerry.” 
50. On or about August 31, 2016, CORSI emailed STONE at 
i | “Did you get the PODESTA writeup.” STONE replied “[y]es.” 

51. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52.  Onor about September 6, 2016, CORSI emailed STONE at 

O KO Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24, 2016, QE CORSI, “I will have much: 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.” O back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan; I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators, inn indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 


54. On or about October 3, 2016, an associate of STONE emailed STONE at 


O= K asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 
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back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

55.  Onor about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful rOn in three different states, as well as, of course, 
information r E S referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on EE subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. | Onor about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE at «what was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his lawyer {is a big 
democrat.” 

58. | When BANNON spoke with investigators dating a voluntary interview on 


February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
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was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. 


59. According to a publicly available news article,’ at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

60. According to phone records [i at approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

64. At approximately 4:00PM, the Washington Post published a story regarding the 


Access Hollywood tape. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 1d74714-8ce5-1 1e6-875e-2c 1 bfe943b66_story.html 
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65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE vin ii i expect 


that much of next dump focus, setting stage for Foundation debacle.” 
66. At approximately 6:27PM, 0O E author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 
= QR BE: <ssazc to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 


G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

68. Onor about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
vin emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 


Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 


om 
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69. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at TA O O the subject 
line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking re Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons Miough the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
. CORSI back via the Hotmail Account, “Got them and used them.” 

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at 
DERN] “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like BE NG maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once (= 
had the channel open from Metcombank to Deutsche Bank America to Banfk] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.} I’m working on that angle now.” STONE replied, “Ok Give me 


SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 
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72. Onor about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email at ae the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In ie post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did —— a controversial Russian billionaire 
investor with ties to the Viadimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by P| with the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. Onor about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. Onor about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 
intel to share.” 


75. On or about October 17, 2016, CORSI emailed STONE at 


E E E 
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ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.| I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pls call. Important.” 

77. Onor about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. | 

78. Onor about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
econiiratitations. Roger. He could not have done it without you.” 

| 80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 
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88. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee, In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. . . . 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange{] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between”.and “mutual friend.” All of these monikers are equally 
true. 


89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 


encouragement been in any type of contact with Julian Assange? 
MR. STONE: No. 
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Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary — 
MR. STONE: That — 
Q: -- was the length and the breadth of what you were referring to? 
MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions. 
90. Inthe month that followed his testimony before HPSCI, on or about October 24, 
- 2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “Stonewall it. Plead the fifth. Anything to 
save the plan’........ Richard Nixonf.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 


wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 


happening in DC the day before Thanksgiving — why are u busting my chops?” 
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93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them — which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff].] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely a 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 


content of the material.” 
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97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.]* You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth .. . You want me to cover you for perjury 
now|.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure , 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back . . . and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” 

98. | STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 


never had a back Channel particularly on June 12th{.]” STONE responded: “You got nothing.” 


4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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99. Onor ajau December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon].]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That mi my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs . . . + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee . . . But you'll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence|.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You area stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “Pm going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 


. . When you start bringing up my dog, you’re crossing the line[.]”° 


5 https://www. yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 
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104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.° In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 
He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 


have prostate cancer and did not have any such discussion with STONE. 


G O Regarding STONE’s Use of Social Media 
105. On or about Friday, May 18, 201 7 was voluntarily interviewed 


by investigators from the Special Counsel’s Office. = Q investigators that he became 
STONE’s assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE’s 
right-hand man.’ 

106. According Rs cone utilized the services of oe individuals to 
post social media content to Facebook and Twitter, and that no ë g STONE both 
instructed these individuals about what to post. 0 xc that he purchased a couple 
hundred fake Facebook accounts as part of this work (including both new and existing accounts), 
and that bloggers working for STONE would try to build what looked like real Facebook 
accounts. 

107. | stated that STONE wanted to push out WikiLeaks content 
through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails 


was pushed out through STONE’s Facebook and Twitter accounts. 


6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 


mi: investigators that he would sometimes send emails from STONE’s account. 
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108. In or around August 2018, pursuant to a warrant issued by Chief Judge Howell, 
the FBI searched several Facebook accounts associated with STONE, which (among other 
things) were used to purchase Facebook advertisements. Search warrant returns for one of those 


-Z 0 that STONE or one of his associates created an ad 


campaign on or about August 26, 2016, that included the text, “The Democrats are right to fear 


Assange’s next email drops will be devastating to Hillary.” The same account was also used to 
create and run a Facebook ad campaign on or about March 28, 2017, that included the following 
text: “ROGER STONE - NO consensus that Guccifer 2.0 is a ‘Russian Asset’ just because US 
Intel says he is.” 

L. The Target Account 


109. According to subscriber records, the email account [ii 


was created on August 17, 2015, in the name of “Falo Memo Tio.”* STONE’s Hotmail account 


ae: listed as the recovery email for the account. In my training and 


experience, when setting up a new email account, users typically provide an email account under 


their control as the recovery account in order to ensure continued access to the new account, for 
example, in the event a password is lost or compromised. Accordingly, there is probable cause 
to believe that STONE controls (directly, or through an employee or associate) the email account 


110. The government obtained non-content information associated with the 


SSS pursuant to an order issued by Chief J udge Howell under 18 U.S.C. 


8 Subscriber records list the “Language Code” for the email account as “pt_BR.” J believe this 
indicates that the subscriber selected Brazilian Portuguese as the primary language for the 
account. Based on machine translation, the customer name “Falo Memo Tio” translates from 
Portuguese to “I speak Memo Uncle.” 
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§ 2703(d). Although subscriber records indicate that the last login to the email account took 
place on August 18, 2015, header information shows that the account continued to receive emails 
until at least July 27, 2018, including from companies that offer advertisement placements. 

111. Header information shows that the email account received multiple emails from 
Facebook between approximately November 3, 2016 and November 7, 2016, shortly before the 
USS. presidential election. On or about October 5, 2016, the email account also received an 
email from adsense-noreply@google.com, an account that I believe is associated with Google 
AdSense. According to open source information, Google AdSense is a program that matches ads 
to websites based on their content and visitors, and it allows individuals to place targeted 
advertising on its network of content sites. 

112. Based on a query performed through Facebook’s law enforcement portal, the FBI 
has confirmed that the email acon o registered to an active 
Facebook account. As explained further below, in my training and EE I know that, in 
addition to posting content and purchasing advertisements, F acebook accounts can be used to 
communicate privately and directly with other users through Facebook’s messaging function. 
This function is similar to the direct messaging function of Twitter, which STONE used to 
communicate with WikiLeaks and ASSANGE in 2016 and 2017. 


BACKGROUND CONCERNING FACEBOOK 


113. Facebook owns and operates a free-access social networking website of the same 
name that can be accessed at http://www.facebook.com. Facebook allows its users to establish 
accounts with Facebook, and users can then use their accounts to share written news, photographs, 


videos, and other information with other Facebook users, and sometimes with the general public. 
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114. Facebook asks users to sited basic contact and personal identifying information 
to Facebook, either during the registration process or thereafter. This information may include the 
user’s full name, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook 
security questions and answers (for password retrieval), physical address (including city, state, and 
zip code), telephone numbers, screen names, websites, and other personal identifiers. Facebook 
also assigns a user identification number to each account. 

115. Facebook users may join one or more groups or networks to connect and interact 
with other users who are members of the same group or network. Facebook assigns a group 
identification number to each group. A Facebook user can also connect directly with individual 
Facebook users by sending each user a “Friend Request.” If the recipient of a “Friend Request” 
accepts the request, then the two users will become “Friends” for purposes of Facebook and can 
exchange communications or view information about each other. Each Facebook user’s account 
includes a list of that user’s “Friends” and a “News Feed,” which highlights Dimma about the 
user’s “Friends,” such as profile changes, upcoming events, and birthdays. 

116. Facebook users can select different levels of privacy for the communications and 
information associated with their Facebook accounts. By adjusting these privacy settings, a 
Facebook user can make information available only to himself or herself, to particular Facebook 
users, or to anyone with access to the Internet, including people who are not Facebook users. A 
Facebook user can also create “lists” of Facebook friends to facilitate the application of these 
privacy settings. Facebook acçounts also include other account settings that users can adjust to 
control, for example, the types of notifications they receive from Facebook. 

117. Facebook users can create profiles that include photographs, lists of personal 


interests, and other information. Facebook users can also post “status” updates about their 
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whereabouts and actions, as well as links to videos, photographs, peels and other items available 
elsewhere on the Internet. Facebook users can also ae information about upcoming “events,” 
such as social occasions, by listing the event’s time, location, host, and guest list. In addition, 
Facebook users can “check in” to particular locations or add their geographic locations to their 
Facebook posts, thereby revealing their geographic locations at particular dates and times. A 
particular user’s profile page also includes a “Wall,” which is a space where the user and his or 
her “Friends” can post messages, attachments, and links that will typically be visible to anyone 
who can view the user’s profile, 

118. Facebook allows users to upload photos and videos, which may include any 
metadata such as location that the user transmitted when s/he uploaded the photo or video. It also 
provides users the ability to “tag” (i.e., label) other Facebook users in a photo or video. When a 
user is tagged in a photo or video, he or she receives a notification of the tag and a link to see the 
photo or video. For Facebook’s purposes, the photos and videos associated with a user’s asui 
will include all photos and videos uploaded by that user that have not been deleted, as well as all 
photos and videos uploaded by any user that have that user tagged in them. 

119. Facebook users can exchange private messages on Facebook with other users. 
These messages, which are similar to e-mail messages, are sent to the recipient’s “Inbox” on 
Facebook, which also stores copies of messages sent by the recipient, as well as other information. 
Facebook users can also post comments on the Facebook profiles of other users or on their own 
profiles; such comments are typically associated with a specific posting or item on the profile. In 
addition, Facebook has a Chat feature that allows users to send and receive instant messages 


through Facebook. These chat communications are stored in the chat history for the account. 
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Facebook also has a Video Calling feature, and although Facebook does not record the calls 
themselves, it does keep records of the date of each call. 

120. Ifa Facebook user does not want to interact with another user on Facebook, the 
first user can “block” the second user from seeing his or her account. 

121. Facebook has a “like” feature that allows users to give positive feedback or connect 
to particular pages. Facebook users can “like” Facebook posts or updates, as well as webpages or 
content on third-party (i.e., non-Facebook) websites. Facebook users can also become “fans” of 
particular Facebook pages. 

122. Facebook has a search function that enables its users to search Facebook for 
keywords, usernames, or pages, among other things. 

123. Each Facebook account has an activity log, which is a list of the user’s posts and 
other Facebook activities from the inception of the account to the present. The activity log includes 
stories and photos that the user has been tagged in, as well as connections made through the 
account, such as “liking” a Facebook page or adding someone as a friend. The activity log is 
visible to the user but cannot be viewed by people who visit the user’s Facebook page. 

124. Facebook Notes is a blogging ats available to Facebook users, and it enables 
users to write and post notes or personal web logs (“blogs”), or to import their blogs from other 
services, such as Xanga, LiveJournal, and Blogger. 

125, The Facebook Gifts feature allows users to send virtual “gifts” to their friends that 
appear as icons on the recipient’s profile page. Gifts cost money to purchase, and a personalized 
message can be attached to each gift. Facebook users can also send each other “pokes,” which are 
free and simply result in a notification és the recipient that he or she has been “poked” by the 


sender. 
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126. Facebook also has a Marketplace feature, which allows users to post free classified 
ads. Users can post items for sale, housing, jobs, and other items on the Marketplace. 

127. In addition to the applications described above, Facebook also provides its users 
with access to thousands of other applications (“apps”) on the Facebook platform. When a 
Facebook user accesses or uses one of these applications, an update about that the user’s access or 
use of that application may appear on the user’s profile page. 

128. Some Facebook pages are affiliated with groups of users, rather than one individual 
user. Membership in the group is monitored and regulated by the administrator or head of the 
group, who can invite new members and reject or accept requests by users to enter. Facebook can 
identify all users who are currently registered to a particular group and can identify the 
administrator and/or creator of the group. Facebook uses the term “Group Contact Info” to 
describe the contact information for the group’s creator sage administrator, as well as a PDF of 
the current status of the group profile page. 

129. Facebook uses the term “Neoprint” to describe an expanded view of a given user 
profile. The “Neoprint” for a given user can include the following information from the user’s’ 
profile: profile contact information; News Feed information; status updates; links to videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends’ 
Facebook user identification numbers; groups and networks of which the user is a member, 
including the groups’ Facebook group identification numbers; future and past event postings; 
rejected “Friend” requests; comments; gifts; pokes; tags; and information about the user’s access 
and use of Facebook applications. 

130. Facebook also retains Internet Protocol (“IP”) logs for a given user ID or IP address. 


These logs may contain information about the actions taken by the user ID or IP address on 
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Facebook, including information about the type of action, the date and time of the action, and the 
user ID and IP address associated with the action. For example, if a user views a Facebook profile, 
that user’s IP log would reflect the fact that the user viewed the profile, and would show when and 
from what IP address the user did so. 

131. Social networking providers like Facebook typically retain additional information 
about their users’ accounts, such as information about the length of service (including start date), 
the types of service utilized, and the means and source of any payments associated with the service 
(including any credit card or bank account number). In some cases, Facebook users may 
communicate directly with Facebook about issues relating to their basini, such as technical 
problems, billing inquiries, or complaints from other users. Social networking providers like 
Facebook typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. 

132. As explained herein, information stored in connection with a Facebook account 
may provide crucial evidence of the “who, what, why, when, where, and how” of the criminal 
conduct under investigation, thus enabling the United States to establish and prove each element 
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Facebook user’s “Neoprint,” IP log, stored electronic E and other data retained by 
Facebook, can indicate who has used or controlled the Facebook account. This “user attribution” 
evidence is analogous to the search for “indicia of occupancy” while executing a search warrant 
at a residence. For example, profile contact information, private messaging logs, status updates, 
and tagged photos (and the data associated with the foregoing, such as date and time) may be 


evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook 
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account activity can show how and when the account was accessed or used. For example, as 
described herein, Facebook logs the Internet Protocol (IP) addresses from which users access their 
accounts along with the time and date. By determining the physical location associated with the 
logged IP addresses, investigators can understand the chronological and geographic context of the 
account access and use relating to the crime under investigation. Such information allows 
investigators to understand the geographic and chronological context of Facebook access, use, and 
events relating to the crime under investigation. Additionally, Facebook builds geo-location into 
some of its services. Geo-location allows, for example, users to “tag” herono in posts and 
Facebook “friends” to locate each other. This geographic and timeline information may tend to 
either inculpate or exculpate the Facebook account owner. Last, Facebook account activity may 
provide relevant insight into the Facebook account owner’s state of mind as it relates to the offense 
under investigation. For example, information on the Facebook account may indicate the owner’s 
motive and intent to commit a crimé (e.g., information indicating a plan.to commit a crime), or 
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from 
law enforcement). 

133. Therefore, the computers of Facebook are likely to contain all the material 
described above, including stored electronic communications and information concerning 
subscribers and their use of Facebook, such as account access information, transaction information, 
and other account information. 


FILTER REVIEW PROCEDURES 


134. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 


with professional responsibility requirements concerning the maintenance of attorney-client and 
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other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
CONCLUSION 

135. Based on the forgoing, I request that the Court issue the proposed search warrant. 

136. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

137. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Curtis Heide 
Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this a9 day of August, 2018. 


James E. Boasberg 
istrict Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the Facebook accounts registered to 


the following email addresses, stored at premises owned, maintained, controlled, or operated by 


Facebook, Inc. (“Facebook”), a company headquartered in Menlo Park, California: 


Case 1:19-mc-00029-CRC Document 29-19 Filed 04/28/20 Page 53 of 56 


ATTACHMENT B 
I. Information to be disclosed by Facebook 
To the extent that the information described in Attachment A is within the possession, 
custody, or control of Facebook, Inc. (“Facebook”), including any messages, records, files, logs, 
or information that have been deleted but are still available to Facebook, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Facebook is required to disclose the 
following information to the government for each account listed in Attachment A: 
(a) All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers. 
(b) All activity logs for the account and all other documents showing the user’s posts 
and other Facebook activities; | 
(c) All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 
(d) All profile information; News Feed information, status updates; videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including 
the friends’ Facebook user identification numbers; groups and networks of which 
the user is a member, including the groups’ Facebook group identification numbers; 
future and past event postings; rejected “Friend” requests; comments; gifts; pokes; 


tags; and information about the user’s access and use of Facebook applications, 
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(e) 


(f) 
(g) 


(h) 
G) 


G) 
(k) 
()) 
(m) 
(n) 
(0) 


(p) 


(q) 
(r) 


All other records of communications and messages made or received by the user, 
including all private messages, chat history, video calling history, and pending 
“Friend” requests; 

All records relating to machine cookies; 

All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

All IP logs, including all records of the IP addresses that logged into the account; 
All records of the account’s usage of the “Like” feature, including all Facebook 
posts and all non-Facebook webpages and content that the user has “liked”; 

All information about the Facebook pages that the account is or was a “fan” of: 
All past and present lists of friends created by the account; 

All records of Facebook searches performed by the account; 

All information about the seb access and use of Facebook Marketplace; 

The types of service utilized by the user; 

The length of service (including start date) sa the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
information for the creator and/or administrator of the group and a PDF of the 
cutrent status of the group profile page; 

‘All past and present Admins for the group; 


The “Creator” of the group; 


Ap 
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(s) 


0 


(u) 


All privacy settings and other account settings, including privacy settings for 
individual Facebook posts and activities, and all records showing which Facebook 
users have been blocked by the account; 

All records pertaining to communications between Facebook and any person 
regarding the user or the user’s Facebook account, including contacts with support 
services and records of actions taken; | 

All records related to advertisements and advertising conducted through the 
accounts, including advertisements purchased, advertising parameters (search 


terms, groups, geographic areas) selected and queried. 


IE. Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud); and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2015 to the present, including: 


a. 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 


or other obfuscation about knowledge of, or access to, hacked material, 
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All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, =o G 
R OOOO EEN 


individual associated with the Trump Campaign: 

Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, | foreign entities, foreign persons, or foreign 
principals; 

All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign difidials, foreign entities, foreign persons, or 
foreign principals; 

Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation, 

The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 
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AO 93 (Rey, 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 


District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH ONE ACCOUNT 
STORED AT PREMISES 
CONTROLLED BY GOOGLE 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


Case: 1:18-sc-02728 | 
Assigned To : Chief Judge Beryl A. Howell 
Assign. Date : 8/28/2018 

Description: Search and Seizure Warrant 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before September 11, 2018 (not to exceed 14 days) 
Mí in the daytime 6:00 a.m. to 10:00 p.m. Dat any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. James E. Boasberg, U.S. District Judge 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for _ days (not to exceed 30) C until, the facts justifying, the later specific date of 


: ; p 
i t 
Date and time issued: a A K 2.5} fin. | & i \ 


City and state: Washington, DC Hon. James Æ. Boasberg, U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13} Search and Seizure Warrant (Page 2) 
Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 


designated judge. 


Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Google accounts, which 
are stored at premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a 


company headquartered in Mountain View, California: 


~l- 


Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 4 of 49 


ATTACHMENT B 


I Information to be disclosed by Google 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 


information that have been deleted but are still available to Google, or have been preserved 


pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 


information to the government for each account listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft snails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

The types of service utilized; 

All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 


actions taken; 


f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All Google Analytics information associated with the account (including all 


properties and UA codes associated with the account, and, for each of these 


proprieties and UA codes, all usernames and email accounts associated with them); 


j. All Google Developers Console information associated with the account; 
k. All Minutemaid information associated with the account; 

L. All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; | 


q. All Web & App Activity associated with the account; 


r. All Google Drive information associated with the account; 
s. All Google+ information associated with the account; 
t. All device information associated with the account, including all instrument or 


telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 


Identifier ““MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (IMSI’), or 
International Mobile Equipment Identities (““IMEI”)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 

linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

I. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 

abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 

U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 

access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 

conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2015 to the present, including: 
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All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, a! Julian 


individual associated with the Trump Campaign; 

Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, aetuding any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 


to the crimes under investigation and to the account owner; 


h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 
i. The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

L The identity of any non-U.S. person(s}—including records that help reveal the 
whereabouts of the person(s}—-who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

0. All existing printouts from original storage which concern the categories identified 


in subsection II.a. 


AO 106 (Rev, 04/10) Application ‘for a Search Warrant 
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UNITED STATES District Court FERED 
for the AUG 2 8 2088 


District of Columbia Clerk, U.S. District & Bankruptey 
Courts for the District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED 
BY GOOGLE 


Case: 1:18-sc—02728 

Assigned To : Chief Judge Beryl A. Howell 
Assign. Date : 8/28/2018 

Description: Search and Seizure Warrant 


Nee ne nee Se ee” ee 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 

located in the Northern District of California , there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
Mf evidence of a crime; 
contraband, fruits of crime, or other items illegally possessed; 
Nf property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
52 U.S.C. § 30121 Foreign Contribution Ban 
18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l ` 
The application is based on these facts: 
See attached Affidavit. 


Æ Continued on the attached sheet. 


© Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


C eae, Abe tt 


Applicant's signature 


Curtis Heide, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


Date: Jj Llp $ 


City and state: Washington, D.C. 


“Printed name and title 
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AUG 2 8 2018 


IN THE UNITED STATES DISTRICT COURT a U.S. Distct & Bankruptey 
FOR THE DISTRICT OF COLUMBIA Or the District of Columbia 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02728 

INFORMATION ASSOCIATED WITH Assigned To : Chief Judge Beryl A. Howell 
ONE ACCOUNT STORED AT PREMISES Assign. Date : 8/28/2018 

CONTROLLED BY GOOGLE Description: Search and Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows: _ 
INTRODUCTION AND AGENT BACKGROUND 

L, I make this affidavit in o of an application for a search warrant for 
information aad with the Google account o= RB Account”), 
stored at premises owned, maintained, controlled or operated by Google, LLC (“Google”), a 
company headquartered in Mountain View, California. The information to be disclosed by Google 
and searched by the government is described in the following paragraphs and in Attachments A 
and B. 

2. I have been a Special Agent with the Federal Bureau of investigation for 12 years. 
In the course of my duties, I have been responsible for investigating federal crimes and national 
security matters involving both annens and issues related to cybersecurity. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4, Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contain evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
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abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 
JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 
(c)(i)(A). Specifically, the Court is “a district court of the United States (including a magistrate 


judge of such a court)... that has jurisdiction over the offense being investigated.” 18 U.S.C. 


§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 


PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 
6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign’’) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 


continued to make media appearances in support of the Campaign. As described further below, 
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STONE also maintained coniac with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 


contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 


Election 

9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence E as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services ondici cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks . 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 


in the compromise of the personal e-mail accounts of Democratic Party officials and political 


figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 
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12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guecifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign.. These 
emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals gsti with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 


against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
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presidential election, including conspiracy to commit authorized access to protected computers. 


See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 
C. STONE?’s Public Interactions with Guccifer 2.0 and WikiLeaks | 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 


why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 


decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would | 


see for themselves how the Democrats had rigged the game.” 
22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 


ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
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aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE doni: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
iater, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. . On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJ StoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStonelJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR; STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 


day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
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[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez. 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On.the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” | 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Helivwood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 


to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 
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. 33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had sane warning fof the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s tavad to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I ve I must be innocent of | 
charges I knew about the hacking of Podesta’s email (speculation and Sones al the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE?’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 
35, On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 


Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
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account @wikileaks.' The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. Onor abadi October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 


indisputably stolen from the government and the courts ruled it was legal to do so and refused to 


l On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStonedJr. 
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issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you EF to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Cocaine Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with STONE, ae... Others Regarding 
Forthcoming Leaks 


41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for sTone’s i diss On October 


17, 2017, Chief Judge Howell issued a search warrant for one of STONE’s RRI 


foo. On or about December 19, 2017, Chief Judge Howell issued a search 


warrant for A account. On or about March 14, 2018, Chief Judge Howell 


issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. Onor about May 15, 206 emailed CORSI: “Here is my flight 
schedule. Need to get something confirmed now ... .” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 


appears to have forwarded the message to STONE at O) who replied to 


CORSI that, “May meet Manafort -guarantee nothing.” 
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.43. On or about May 18, 2016, CORSI emailed STONE iii 


with the title, “Roger -- why don't you look this over before I send it I believe that 


CeO 
See and I did manage to see Mr. Trump for a few minutes today as we were 


waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 


was very cordial. He would look for this memo from you this afternoon.” 


44. On July 25, 2016, STONE, using ——— aa sent an email to 


CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 


[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

45. On or about July 31, 2016, STONE, 77 OR 
CORSI with the subject line, “Call me MON.” The body of the email read: E should see 
Assange[.| | GN find Bernie [S]anders brother who called Bill a Rapist — turn him for 
Trumpj.] Lael “na or more proof of Bill getting kicked out.” 

On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 
| “Word is friend in embassy plans 2 more dumps. One shortly after Pm 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox- 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games, Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 


hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- 
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neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. Onor about August 5, 2016, ae: associate of STONE’s, emailed 
STONE iii! The email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” ee subsequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet ASSANGE. et also stated 
that in 2018, o Q STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told ae was joking and 
had not actually met ASSANGE.? 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to o . have “dined” with ASSANGE. For example, an aak of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this afternoon{.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 


call later — heading for airport now[.]” Additionally, investigators have identified a photograph in 
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STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 


information indicating that it was taken in Los Angeles. 


49, On or about August 15, 2016, CORSI emailed STONE at 


ae “Give me a call today if you can. Despite MSM drumroll that HRC is 


already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 


until after Labor Day. I’m in NYC this week. Jerry.” 


50. On or about August 31, 2016, CORSI emailed STONE at 


: “Did you get the PODESTA writeup.” STONE replied “[y]es.” 

51. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6, 2016, CORSI emailed STONE at 


PY “Rogerf,] Is NY Post going to use the Pedesta [sic] stuff?” 


53. On or about September 24, 2016 emailed CORSI, “I will have much 


more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 


it again today.” O 8 back, “Awaiting secret file. Explosive... Hope you are well. 


Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 


about filef.]” In a subsequent meeting with investigators, EE R this 


conversation concerned possible derogatory information he was trying to obtain from Turkey. 
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54. On or about October 3, 2016, an associate of STONE emailed STONE at 
0o gQ asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. Pd say that’s 
important.” 

55, On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
© vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it Total BS hype.” 

57. That same day, BANNON emailed STONE iis “What was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his lawyer [J is a big 


democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
` STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 


BANNON had been hoping for releases of damaging information that morning, 


F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails | 


Are Released. 

59. According to a publicly available news article,’ at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage - 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

60. According to phone TE at approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

6l. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 


approximately twenty minutes. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 14747 14-8ce5-1 1le6-875e-2c1 bfe943b66_story.html 
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64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE = ff expect 


that much of next dump focus, setting stage for Foundation debacle.” 
66. At approximately 6:27eM o an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten ainutes later, STONE, using 
a forwarded BEE E to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 


G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

68. — On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
usin i emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 


CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up m it’s easy to understand will take weekend. Your choice?” 
69. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at rot with the subject 
line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 
70, CORSI followed up several minutes later with another email titled, “Podesta 
. talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 
71.  Onor about Thursday, October 13, 2016, CORSI emailed STONE at 
o NN -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI ` 
wrote back to STONE, “Til give you one more — NOBODY YET HAS THIS[:] It looks to me 


like i oo, skimmed maybe billions off Skolkovo — Skolkovo kept their money with 


Metcombank{.] The Russians launched a criminal investigation{.] [web link] Once aaa 


had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 


Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email at Oo g the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name,” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 

_ then asked, “Just how much money did i. controversial Russian billionaire 
iei with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by ae: the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

| 74. On or about October 17,2016, CORSI messaged STONE at his iCloud account, 

_ “On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 

landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 
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75. ` Onor about October 17, 2016, CORSI emailed STONE at 

eee ee with the subject, “Fwd: 
ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is idredientie Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand offf. Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange bas to play out. He’s called Podesta’s bluff and 
raised him the election.” 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

77. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 


2016 discussed above. 


78. Onor about November 8, 2016, the United States presidential election took place. 


79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 


“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 


account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 

_ of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny... . 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 

encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange, 

you were only referring to a single fact that you had confirmed with the intermediary — 

MR. STONE: That — 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails... . [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

91. Onor about November 19, 2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
-save the plan’........ Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. . Onor about November 21, 2017, CREDICO messaged STONE, “I was told that 


the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
Sth Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 


journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 


he had the goods [o]n Hillary and would publish them — which he himself said in public b4 u told 


me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff]. l I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not Aiari because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. | STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. Onor about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 


“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 
content of the material.” — 

97, Onor about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.]* You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth .. . You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure | 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back . . . and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony. before I testify on the 15th.” STONE replied, “If 
you testify you're a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify{.]” | 

98. - STONE and CREDICO continued to message each other on or about December 1, 


2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 


4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99, On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs . . . + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” | 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee . . . But you'll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence|.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You area stoolie. You backstab your friends — run your mouth my 


lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
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from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you start bringing up my dog, you’re crossing the linef.” 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.® In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 
He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 


have prostate cancer and did not have any such discussion with STONE. 


K. RE statements Regarding STONE’s Use of Social Media 


105. On or about Friday, May 18, 2018, D.. voluntarily interviewed 


by investigators from the Special Counsel’s Oftice investigators that he became 
STONE’s assistant in Florida in 2015, and that during the summer of 2016, he acted as STONE’s 
right-hand man. 

106. According o STONE utilized the services of several individuals to 
post social media content to Facebook and Twitter, and that he -X STONE both 
instructed these individuals about what to post. = Q that he purchased a couple 
hundred fake Facebook accounts as part of this work (including both new and existing accounts), 
and that bloggers working for STONE would try to build what looked like real Facebook 


accounts. 


> https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 


6 https://www.motherjones.com/politics/20 1 8/05/roger-stone-to-associate-prepare-to-die/ 
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107, O ES stated that STONE wanted to push out WikiLeaks content 
through his Facebook and Twitter accounts, and that content related to the stolen Podesta emails 
was pushed out through STONE’ s Facebook and Twitter accounts. 

108. Inor around August 2018, pursuant to a warrant issued by Chief Judge Howell, 
the FBI searched several Facebook accounts associated with STONE, which (among other 
things) were used to purchase Facebook advertisements. Search warrant returns for one of those 
accounts es show that STONE or one of his associates created an ad 
campaign on or about August 26, 2016, that included the text, “The Democrats are right to fear 
Assange’s next email drops will be anik to Hillary.” The same account was also used to 
create and run a Facebook ad campaign on or about March 28, 2017, that included the following 
text: “ROGER STONE - NO consensus that Guccifer 2.0 is a ‘Russian Asset’ just because US 
Intel says he is.” 

L. The Target Account 


109. According to subscriber records, Target Account ae «:: 


created on August 17, 2015, in the name of “Falo Memo Tio.””? STONE’s o QN 
een listed as the recovery email for the Target Account. In my training and 
experience, when setting up a new email account, users typically provide an email account under 
their control as the recovery account in order to ensure continued access to the new account, for 


example, in the event a password is lost or compromised. 


7 Subscriber records list the “Language Code” for the Target Account as “pt_BR.” I believe 

this indicates that the subscriber selected Brazilian Portuguese as the primary language for the 
account. Based on machine translation, the customer name “Falo Memo Tio” translates from 

Portuguese to “I speak Memo Uncle.” 
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110. The government obtained non-content information associated with the Target 
Account pursuant to an order issued by Chief Judge Howell under 18 U.S.C. § 2703(d). 
Although subscriber records indicate that the last login to the Target Account took place on 
August 18, 2015, header information shows that the account continued to receive emails until at 
least July 27, 2018, including from IEN that offer advertisement placements. 

111. Header information shows that the Target Account received multiple emails 
from Facebook between approximately November 3, 2016 and November 7, 2016, shortly before 
the U.S. presidential election. On or about October 5, 2016, the Target Account also received 
an email from adsense-noreply@google.com, an account that I believe is associated with Google 
AdSense. According to open scarce information: Google AdSense is a program that matches ads 
to websites based on their content and visitors, and it allows individuals to place targeted 
advertising on its network of content sites. 

BACKGROUND CONCERNING GOOGLE 

112. In my training and experience, I have learned that Google provides a variety of on- 
line services, including Sections mail (“email”) access, to the public. Google allows subscribers 
to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers 
obtain an account by registering with Google. During the registration process, Google asks 
subscribers to provide basic personal information. Therefore, the computers of Google are likely 
to contain stored electronic communications (including retrieved and unretrieved email) for 
Google Mail subscribers and information concerning subscribers and their use of Google Mail 
services, such as account access information, email transaction information, and account 


application information. In my training and experience, such information may constitute evidence 
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of the crimes under investigation because the information can be used to identify the account’s 
user or users. l 

113. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

114. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(i.e., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
- logging into the account via the provider’s website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the IP address used to register the 
account and the IP addresses associated with particular logins to the account. Because every device 
that connects to the Internet must use an IP address, IP address information can help to identify 
which computers or other devices were used to access the email account. 

115. In my training and experience, in some cases, email account users will 


communicate directly with an email service provider about issues relating to the account, such as 


a 
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technical problems, billing inquiries, or Sare from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

116. This application seeks a warrant to search all responsive records and information 
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where 
Google has chosen to store such information. The government intends to require the disclosure 
pursuant to the requested warrant of the contents of wire or electronic communications and any 
records or other information pertaining to the customers or subscribers if such communication, 
record, or other information is within Google’s possession, custody, or control, regardless of 
whether such communication, record, or other information is stored, held, or maintained outside 
the United States. 

117. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 


the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 


while executing a search warrant at a residence. For example, email communications, contacts 


lists, and images sent (and the data associated with the foregoing, such as date and time) may 


indicate who used or controlled the account at a relevant time. Further, information maintained by 
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the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
| physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time (¢.g., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
wak into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g., communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 
FILTER REVIEW PROCEDURES 


118. Review of the items described in Attachment A and Attachment B will be 


conducted pursuant to established procedures designed to collect evidence in a manner consistent’ 


with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
CONCLUSION 
119. Based on the forgoing, I request that the Court issue the proposed search warrant. 
120. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 


required for the service or execution of this warrant. 
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REQUEST FOR SEALING 


121. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 


documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this JA day of August, 2018. 


Thé Honérabledathes E. Boasberg 
e s District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Google accounts, which 
are stored at premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a 


company headquartered in Mountain View, California: 
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ATTACHMENT B 


I. Information to be disclosed by Google 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 


information that have been deleted but are still available to Google, or have been preserved 


pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 


information to the government for each account listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

The types of service utilized; 


All records or other information stored at any time by an individual using the 


- account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 


| 
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e. All records pertaining to communications between the Provider and any person 


regarding the account, including contacts with support services and records of 


actions taken; 
f. AH subscriber “change history” associated with the account; 
g. Ali search history and web history associated with the account; | 
h. All location and maps information associated with the account; 
i. All Google Analytics information associated with the account (including all 


properties and UA codes associated with the account, and, for each of these 


proprieties and UA codes, all usernames and email accounts associated with them), 


j. All Google Developers Console information associated with the account; 
k. All Minutemaid information associated with the account; 

l. All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account, 


q. All Web & App Activity associated with the account; 


r. All Google Drive information associated with the account; 
s. All Google+ information associated with the account; 
t. AH device information associated with the account, including all instrument or 


telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 


Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI”); and 


u. For any accounts linked to the accounts listed in Attachment A, including accounts 


linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account inbe 
Il. Information to be Seized by the Government 
Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 E 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
. conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2015 to the present, including: 


-4- 
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All records, information, documents or tangible materials that relate in any way to 

communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, Julian 


Assange, Randy Credico, or any 
individual associated with the Trump Campaign; 

Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 


any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 


Case 1:19-mc-00029-CRC Document 29-20 Filed 04/28/20 Page 49 of 49 


Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

All existing printouts from original storage which concern the categories identified 


in subsection II.a. 


Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page1of48 | 
AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 

In the Matter of the Search of ) | 
(Briefly describe the property to be searched ) Case: 1:18-sc-02729 
or identify the person by name and address) ) Assigned To : Chief Judge Beryl A. Howell 

INFORMATION ASSOCIATED WITH ONE ACCOUNT ) Assign. Date : 8/28/2018 
STORED AT PREMISES ) Description: Search and Seizure Warrant 
CONTROLLED BY 1&1 MAIL & MEDIA, INC. ) 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Eastern District of Pennsylvania 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before September 11, 2018 (not to exceed 14 days) 
in the daytime 6:00 a.m. to 10:00 p.m. Oat any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. James E. Boasberg, U.S. District Judge 
(United States Magistrate Judge) 


C Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) C until, the facts justifying, the later specific date of 


Date and time issued: g j DIR 3 i g fe 


City and state: Washington, DC Hon. ia E. Boasberg, U.S. District Judge 


Printed name and title 
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Date and time warrant executed: Copy of warrant and inventory left with: 
Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following 1&1 Mail accounts, 
which are stored at premises owned, maintained, controlled, or operated by 1&1 Mail & Media, 


Inc. (“1&1 Mail”), a company headquartered in Chesterbrook, Pennsylvania: 
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ATTACHMENT B 


I. Information to be disclosed by 1&1 Mail 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of 1&1 Mail & Media, Inc. (“1&1 Mail”), including any messages, records, 


files, logs, or information that have been deleted but are still available to 1&1 Mail, or have been 


preserved pursuant to a request made under 18 U.S.C. § 2703(f), 1&1 Mail is required to disclose 


the following information to the government for each account listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

The types of service utilized; 

All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 


actions taken; 


f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All device information associated with the account, including all instrument or 


telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”’), or 
International Mobile Equipment Identities “IMET”)); and 

j. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 


source of payment (including any credit or bank account number). 
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IL. Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2015 to the present, including: 


a. 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome cori, Julian 


individual associated with the Trump Campaign; 

Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 


principals; 


-4- 
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e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

£ Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed rusai: to determine 
the geographic and chronological context ofaccount access, use, and events relating 


to the crimes under investigation and to the account owner; 


h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 
i. The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication, and 

m. The identity of any person(s)—including records that help reveal the whereabouts 


of the person(s)—who communicated with the account about any matters relating 


5. 
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to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

0. All existing printouts from original storage which concern the categories identified. 


in subsection II.a. 


AO 106 (Rev. 04/19 


UNITED STATES DISTRICT COURT FILED 
for the AUS 2 8 2018 


District of Columbia Clerk, U.S. District & Bankrupiey 


Courts for the District af Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED 
BY 1&1 MAIL & MEDIA, INC. 


Case: 1:18-sc-02729 

Assigned To : Chief Judge Beryl A. Howell 
Assign. Date : 8/28/2018 

Description: Search and Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 

located in the Eastern District of ____ Pennsylvania , there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
mM evidence of a crime; 
W contraband, fruits of crime, or other items illegally possessed; 
& property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person whe is unlawfully restrained. 


The search is related to a violation of: 


`- Code Section Offense Description 
52 U.S.C. § 30121 Foreign Contribution Ban 
18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l ; 
The application is based on these facts: . 
See attached Affidavit. 


A Continued on the attached sheet. 


© Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Le ee 


Applicant's signature 


Curtis Heide, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


Date: ` 4 Josja 


City and state: Washington, D.C. 


Printed name and title 
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FILE 
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IN THE UNITED STATES DISTRICT COURT AUG 28 2018 


FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF 


INFORMATION ASSOCIATED WITH Case: 1:18-sc-02729 ee, 
ONE ACCOUNT STORED AT PREMISES Assigned To : Chief Judge Beryl A. How 
CONTROLLED BY 1&1 MAIL & MEDIA, Assign. Date : 8/28/2018 i 
INS: Description: Search and Seizure Warran 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


L Curtis Heide, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

l. I make this affidavit in support of an application for a search warrant for 
information associated with the 1&1 Mail T ë ER Account”), 
stored at premises owned, maintained, controlled or operated by 1&1 Mail & Media, Inc. (“1&1 
Mail”), a NT headquartered in Chesterbrook, Pennsylvania. The information to be disclosed 
by 1&1 Mail and searched by the government is described in the following paragraphs and in 
Attachments A and B. 

2, I have been a Special Agent with the Federal Bureau of investigation for 12 years. | 
In the course of my duties, I have been responsible for investigating federal crimes and national 
security matters involving both counterintelligence and issues related to cybersecurity. 

3. The facts in this affidavit come from my personal Sania, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4, Based on my training and experience and the facts as set forth in this affidavit, 


there is probable cause to believe that the Target Account contain evidence, fruits, or 


te 
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instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 
JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 
(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 


judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 


§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 


PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 
6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 


continued to make media appearances in support of the Campaign. As described further below, 


I 
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STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI ya a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 


Ba 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US-Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC ats described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or “trolls.” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s E A 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[iJn July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 


in the compromise of the personal e-mail accounts of Democratic Party officials and political 


figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 


-4- 


Case 1:19-mc-00029-CRC Document 29-21 Filed 04/28/20 Page 14 of 48 


12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15, For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own\technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
_ elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 


against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
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` presidential election, including conspiracy to commit authorized access to protected computers. 


See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

| 19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Gueciter 2.0 also began releasing hacked DNC documents. 

| 20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. | 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0,” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you'll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 
22. On August 8, 2016, STONE addressed the Southwest Broward Republican 

Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 


ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
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aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange . 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24, On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

2s. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 


day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
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[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks,” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary EP P — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
- which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 


“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 


to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 


Ra 
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33.  WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Asanb saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the . 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 
35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 


Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
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account @wikileaks.' The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 


national TV, cable and print defending WikiLeaks and assange against the claim that you are 


Russian agents and debunking the false charges of sexual assault as trumped up bs you may want — 


to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. Onor about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJ StoneJ r containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 

| the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 


indisputably stolen from the government and the courts ruled it was legal to do so and refused to 


1 On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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issue an order restraining the paper from publishing additional articles. If the US government 


moves on you I will bring down the entire house of cards. With the tramped-up sexual assault 


charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That - 


same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 


this forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with stone, g Others Regarding 
Forthcoming Leaks 


41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for Da W i On October 


17, 2017, Chief Judge Howell issued a search warrant for one of STONE s addresses, 


eo ae On or about December 19, 2017, Chief Judge Howell issued a search 


warrant for o 2211 account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 


search warrants indicated the following: 


42. On or about May 15, 0 emailed CORSI: “Here is my flight 
schedule. Need to get something confirmed now... .” CORSI responded, “I copied Roger 


Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 


appears to have forwarded the message to STONE n sa replied to 


CORSI that, “May meet Manafort -guarantee nothing.” 


= Yi 
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43. | Onor about May 18, 2016, CORSI emailed STONE at fe 


with the title, “Roger -- why don't you look this over before I send it 


CORSI wrote, 
0O g I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

44. On July 25, 2016, STONE, using o g an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
`- [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 

Foundation, allegedly.” 


45.  Onor about July 31, 2016, STONE, using a emailed 


CORSI with the subject line, “Call me MON.” The body of the email read: O see 


Assangef.] BE ou find Bernie [S]anders brother who called Bill a Rapist — turn him for 
Trumpf.J | a ind or more proof of Bill getting kicked out.” 
46. Onor about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 
Ae oe “Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact leaned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 


hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- 
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neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. . Onor about August 5, 2016, o associate of STONE’s, emailed 
STONE at ee The email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 


Julian Assange last night.” | stated to investigators that, around the 


that in 2018, o 9 STONE he would be interviewed by the FBI and would have to 


same time, STONE told him he had gone to London to meet ASSANGE. 


divulge the conversation about meeting ASSANGE. STONE told o Q was joking and 
had not actually met ASSANGE.? 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email 5 to have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this afternoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 


call later — heading for airport now[.]” Additionally, investigators have identified a photograph in 


a. 
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STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 
49. On or about August 15, 2016, CORSI emailed STONE at 
| “Give me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 
50. On or about August 31, 2016, CORSI emailed STONE at 


“Did you get the PODESTA writeup.” STONE replied “[y]es.” 


51. On or.about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 

'S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” | 

52. On or about September 6, 2016, CORSI emailed STONE at 

en “Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24, 201 iim T CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.” | back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 


about file[.)” In a subsequent meeting with investigators, a indicated this 


conversation concerned possible derogatory information he was trying to obtain from Turkey. 


J4 
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54.  Onor about October 3, 2016, an associate of STONE emailed STONE at 


O ©: asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 


| 
| 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will | 
| 


be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 


about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 


important.” 


55. On or about October 4, 2016, ASSANGE gave a press conference at the 


Ecuadorian Embassy. There had been speculation in the press leading up to that event that 


ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the US. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE T DR was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his lawyer E is a big 


democrat.” 
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58. | When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
yas about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. l 


59, According to ; publicly available news article,’ at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

60. According to phone on g approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty Aies 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 


approximately twenty minutes. 


: https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 1d74714-8ce5-1 1e6-875e-2c1 bfe943b66_story.html 
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64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE win ii f expect 


that much of next dump focus, setting stage for Foundation debacle.” 


66. Atapproximately 6:27PM, a) an author who has written about the 


Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 


newly-released Podesta emails. Approximately ten minutes later, STONE, using 


O= B | to CORSI without comment. STONE 


does not appear to have forwarded the email to any other individual. 


G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
wing emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 


CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 


sateen pare SSN 


Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 
69. Onor about that same day, October 12, 2016, Podesta accused STONE of having | 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI l | 
emailed STONE t both — E | 
line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE | 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 


70. CORSI followed up several minutes later with another email titled, “Podesta 


talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 
71. On or about Thursday, October 13, 2016, CORSI emailed STONE at 
EE «00:51 -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON F OUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “Pil give you one more — NOBODY YET HAS THIS[:] It looks to me 
like | AS maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once ill 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 


Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank{.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters|.]” 

72. Onor about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email at 0 vic: the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did PI a controversial Russian billionaire — 
investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by | the money 
- transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. Onor about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pmf.]” STONE responded, “Missed u — just: 
landed J FK. — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 
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75. .Onor about October 17, 2016, CORSI emailed STONE at 

rc 
ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off].]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

76. Onor about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pis call. Important.” 

77. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 


2016 discussed above, 


78. On or about November 8, 2016, the United States presidential election took place. 


79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 


“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 


account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 
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I, STONE?’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCT). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. . . . 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 


encouragement been in any type of contact with Julian Assange? 
MR. STONE: No. 


Q: So throughout the many months in which you represented you were either in 
communication with Assange or communication through an intermediary with Assange, 
you were only referring to a single fact that you had confirmed with the intermediary — 
MR. STONE: That — 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 
occasions, 


90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. ... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE?’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to AS SANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’........ Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 


the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange isa 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them — which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff].] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” | 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. . 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 


“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 
content of the material.” 

97. Onor about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.]* You could have just told him the truth iat you didn’t have a 
back Channel they now know that I was not in London until September of this year[{.] You had 
no back-channel and you could have just told the truth . .. You want me to cover you for perjury 
nowJ.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a sade hare and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back . . . and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify seats a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.J” | 

98. STONE and CREDICO continued to message each other on or about December |, 


2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 


4 Contrary to his statement, CREDICO has not provided any forensic evidence to the FBI. 
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STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99, Onor about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you suit do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs . . . + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee . . . But you’ ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic E E I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 


lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 


OTs 
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from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . | 


.. When you start bringing up my dog, you’re crossing the linef.” | 


104. On or about May 25, 2018, CREDICO provided additional messages he stated 


were from STONE to another news agency. In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 
He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 

K. Stone’s Use of the Target Account 

105. According to subscriber records, Target Account a was 

created on November 4, 2015 in the name of Roger Stone, and the last login to the account was 
May 29, 2018.7 


106. Based on communications identified through a court-authorized search of 


STONE’s Gmail account PI I have learned that STONE used Target 
i ooon to send and receive communications about WikiLeaks and 


Assange: 


107. For example, on or about March 21, 2018, STONE used the Target Account to 


send an email with the subject, “Randy [Credico] and Me: The Truth about WikiLeaks.” The 


$ https://www.yahoo.com/news/comedian-randy-credico -says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 


6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 


7 The customer date of birth listed in the subscriber records is not STONE’s birthdate. In my 
training and experience, providers such as 1&1 Mail do not verify customer dates of birth. 
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email appears to be a media blast sent to a distribution list that included STONE’s Gmail account 
= the email, STONE claimed, in substance and in part, that in 2016 he 
had asked Credico to confirm that Assange had credible information on Clinton, and that Credico 
“never said from whom he gained [the] confirmation, or the source, or the content of whatever 
was coming.” 
108. At least one reporter also emailed STONE at the Target Account about 
WikiLeaks and Assange. In particular, on or about May 11, 2018, a reporter with the 


Washington Post emailed STONE at w g Target Account 


rogerstone@mail.com about “a story on the Mueller investigation.” The reporter described “a 
scene TTT when ead says he was asked about an email he received 
from [STONE] that made reference to an upcoming meeting with Julian Assange.” After noting 

, STONE’s position that no meeting with Assange ever occurred, the reporter also asked STONE, 
in substance and in part, if he had anything further to add to the story. 

109. Onor about the same day, STONE responded from his Google account 
ee stating that the email concerning a meeting with Assange was “a joke 
made while trying to get ğ the phone.” STONE also wrote, “Now would be a good time 
for the Washington Post to report that the accusation there was an email that proved that I knew 
about the contents of the WikiLeaks disclosures in advance has never been seen by the 
Washington Post and was then ascribed to a ‘phone call.” 


BACKGROUND CONCERNING 1&1 MAIL 


110. In my training and experience, I have learned that 1&1 Mail provides a variety of 
on-line services, including electronic mail (“email”) access, to the public. 1&1 Mail allows 


subscribers to obtain email accounts at several domain names, including mail.com, like the Target 
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Account. Subscribers obtain an account by registering with 1&1 Mail. During the registration 
process, 1&1 Mail asks subscribers to provide basic personal information. Therefore, the 
computers of 1&1 Mail are likely to contain stored electronic communications (including retrieved 
and unretrieved email for 1&1 Mail subscribers and information concerning subscribers and their 


use of 1&1 Mail services, such as account access information, email transaction information, and 


account application information. In my training and experience, such information may constitute _ 


evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

111. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

112. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(i.e., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 


logging into the account via the provider’s website), and other log files that reflect usage of the 
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account. In addition, email providers sien have records of the Internet Protocol address 
(“IP address”) used to register the account and the IP addresses associated with particular logins 
to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

113. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation pecans the information can be used to identify the 
account’s user or users. 

114. This application seeks a warrant to search all responsive records and information 
under the control of 1&1 Mail, a provider subject to the jurisdiction of this court, regardless of 
where 1&1 Mail has chosen to store such information. The government intends to require the 
disclosure pursuant to the requested warrant of the contents of wire or electronic communications 
and any records or other information pertaining to the customers or subscribers if such 
PEE ET record, or other information is within 1&1 Mail’s possession, custody, or control, 
regardless of whether such communication, record, or other information is stored, held, or 
maintained outside the United States. 

115. As explained herein, information stored in connection with an email account may 


provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
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under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users aches the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time (¢.g., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g., communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 


FILTER REVIEW PROCEDURES 


116. Review of the items described in Attachment A and Attachment B will be 


conducted pursuant to established procedures designed to collect evidence in a manner consistent 
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with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 


CONCLUSION 


117. Based on the forgoing, I request that the Court issue the proposed search warrant, 


118. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 

required for the service or execution of this warrant. 
REQUEST FOR SEALING 

119. 1 further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


pe cued submitted, 


Special Agent 
Federal Bureau of Investigation 


- 
Subscribed and sworn to before me on this 19 day of August, 2018. 


The Honorhble 


T 
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ATTACHMENT A 


Property to be Searched 
This warrant applies to information associated with the following 1&1 Mail accounts, 
which are stored at premises owned, maintained, controlled, or operated by 1&1 Mail & Media, 


Inc. (“1&1 Mail”), a company headquartered in Chesterbrook, Pennsylvania: 
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ATTACHMENT B 


I. Information to be disclosed by 1&1 Mail 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of 1&1 Mail & Media, Inc. (“1&1 Mail”), including any messages, records, 


files, logs, or information that have been deleted but are still available to 1&1 Mail, or have been 


preserved pursuant to a request made under 18 U.S.C. § 2703(f), 1&1 Mail is required to disclose 


the following information to the government for each account listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

All records or other information regarding the identification of the account, to 
include fuli name, physical address, lepio numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

The types of service utilized; 

All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 


actions taken; 


f. All subscriber “change history” associated with the account; 

g. All search history and PH history associated with the account; 

h. All location and maps information associated with the account; 

i, All device information associated with the account, including all instrument or 


telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier ( MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (““IMEI”)); and 

j. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 


source of payment (including any credit or bank account number). 
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I. Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18- 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2015 to the present, including: 


a. 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, Mow. o Julian 


individual associated with the Trump Campaign; 

Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication, 
Records of any funds or benetit disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 


principals; 
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e, All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 


to the crimes under investigation and to the account owner; 


h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 
i. The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

- k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

L The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 


of the person(s)—who communicated with the account about any matters relating 
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to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 


in subsection II.a. 


age 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 

In the Matter of the Search of ) 
(Briefly describe the property to be searched ) Case: 1:1 8-sc-02881 
or identify the person by name and address) ) Assigned To : Howell, BerylA | 

INFORMATION ASSOCIATED WITH ) Assign. Date : 9/24/2018 
ONE VIRTUAL PRIVATE SERVER ) Description: Search & Seizure Warrant 
) 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Western District of Michigan 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before October 8, 2018 (not to exceed 14 days) 
in the daytime 6:00 a.m. to 10:00 p.m. Oat any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) Ù until, the facts justifying, the later specific date of 


Date and time issued: af 2. y, fa AWA ar Z. 10Ah ABA A- LB: 


dge’s signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rey. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 
Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to the virtual private server using the IP address set forth below, which 
is controlled and/or operated by Liquid Web, LLC, a company headquartered in Lansing, 


Michigan: 
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ATTACHMENT B 
I. Information to be disclosed by Liquid Web LLC 
To the extent that the information described in Attachment A is within the possession, 
custody, or control of Liquid Web LLC (hereinafter, “the Provider”), regardless of where such 
information is stored, held or maintained, the Provider is required to disclose the following 
information to the government for the server listed in Attachment A (“Target Server”): 

a. A forensic copy of the contents of the Target Server described in Attachment A; 
information pertaining to the tool and process used to create said forensic copy; a 
log of the process; verification of the process; a record of who created the copy, 
when it was created, and where it was created, including the person’s name, title, 
contact numbers, and address; 

b. A forensic copy of the undisturbed contents of random access memory of the 
running Target Server described in Attachment A; information pertaining to the tool 
and process used to create said forensic copy; a log of the process; verification of 
the process; a record of who created the copy, when it was created, and where it 
was created, including the person’s name, title, contact numbers, and address; 

c. All records of other subscriber information regarding the account, to include ufll 
name, physical address, telephone numbers and other identifiers, records of session 
times and durations, the date on which the account was created, the length of 
service, the types of services utilized, the IP address used to register the account, 
login-in IP addresses associated with session times and dates, account status, 


alternative email addresses provided during registration, methods of connection, 
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log files, and means and source of payment (including any credit or bank account 


numbers); 


. All records pertaining to communications between the Provider and any person 


regarding the account, including contacts with support services and records of 


actions taken. 


I. Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2015 to the present, including: 


a. 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, Julian 


=. 
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individual associated with the Trump Campaign, or any witness in the 
investigation; 

Gi Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

ei All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 


to the crimes under investigation and to the account owner; 


h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 
i, The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 
a Credit card and other financial information, including but not limited to, bills and 


payment records evidencing ownership of the subject account; 
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k. All images, messages and communications regarding wiping software, encryption 

or other methods to avoid detection by law enforcement; 

1. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 
in subsection Ila. 

HI. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 


ast pok 
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eer UNITED STATES DISTRICT COURT Clerk, U.S. District & Bankruptcy 
FOR THE DISTRICT OF COLUMBIA Courts for the District of Golumbla 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02881 
INFORMATION ASSOCIATED WITH ONE Assigned To : Howell, Beryl A. 


Description: Search & Seizure Warrant 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in ee thereof (collectively the “Warrant”), 
and to require Liquid Web, LLC (“Liquid Web”), an electronic communication and/or remote 
computing services provider headquartered in Lansing, Michigan, not to disclose the existence or 
contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Liquid Web and its ` 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Liquid Web for the purpose of receiving legal advice) for a period of one year or until 


further order of the Court. 


A 5 we th” 
THE HONORABLE BERYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 


UAV] 01¥ 


Date 
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UNITED STATES DISTRICT COURT 


SEP 24 20 


for the 
ae cael $ Clark, U.S. District & Bankrupiey 
District of Columbia Courts for the District of Columbia 
In the Matter of the Search of ) Case: 1:18-sc-02881 
Bri de ibe th ‘ty to b hed : 
E ia eik dee a, ; Assigned To : Howell, Beryl A. 
INFORMATION ASSOCIATED WITH ) Assign. Date : 9/24/2018 
ONE VIRTUAL PRIVATE SERVER ) Description: Search & Seizure Warrant 
) 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A 
located inthe Western __ District of Michigan , there is now concealed (identify the 


person or describe the property to be seized): 


See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
om evidence of a crime; 
contraband, fruits of crime, or other items illegally possessed; 
property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
52 U.S.C. § 30121 Foreign Contribution Ban 
18 U.S.C. §§ 1001, 1030,371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 
The application is based on these facts: 
See attached Affidavit. 


( Continued on the attached sheet. 
O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


m_m 


Reviewed by AUSA/SAUSA: l Applicant's signature 
l Patrick J. Myers, Special Agent, FBI 


Printed name and title 


Kyle R. Freeny (ASC) 


Sworn to before me and signed in my presence. 


oae: — G21 / 2 | JE LEC 


Judge's signature 


City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 


Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 11 of 56 — 


cee ne {i fila Le 
Le 


* gt wa Sd IN 

SEP 24 208 
TO SEE eee S ES EAL Glark, U.S. District & Bankruptcy 
FOR THE DISTRICT OF COLUMBIA Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02881 

INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A. 

ONE VIRTUAL PRIVATE SERVER Assign. Date : 9/24/2018 

Description: Search & Seizure Warrant 


AMENDED AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

l. I make this affidavit in support of an application for a search warrant under 18 
U.S.C. §§ 2703(a), 2703(b)(1)(A) and 2703(c)(1)(A). The search warrant seeks authorization to 
search a private server (“Target Server”) controlled and operated by Liquid Web, LLC, a 
company with headquarters in Lansing, Michigan. The virtual private sve (“VPS”) to be 
searched, with Internet Protocol (“IP”) address E- believed to be used by Roger 
STONE and is described further below and in Attachment A. Upon receipt of the information 
described in Attachment A, government-authorized persons will review that information to locate 
the items described in Attachment B. 

2. I am a Special Agent with the Federal Bureau of Investigation (“FBT”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 

3. The facts in this affidavit come from my personal observations, my training and 


experience, and information obtained from other FBI personnel and witnesses. This affidavit is 


: Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 12 of 56 


intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4, Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Server contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (siding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. | 

JURISDICTION 

5, This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 
(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 2711(3)(A)(@). The offense conduct included activities in Washington, D.C., as detailed below. 
PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 
6. Roger STONE is a alBemployad political strategist/consultant and has been 


actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 


Fa 
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Donald J. Trump (the “Campaign” until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii. Jerome CORSI 

Te Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com,” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 


4. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9, On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as ajar 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 


and maintained that access until at least June 2016.” The USIC attributed these cyber activities 


to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
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in the compromise of the personal e-mail accounts of Dermonatie Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12: With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. | 

16. On or about September 4, 2016, individuals aineta with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 


elections in numerous Florida counties. 
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18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
-on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They wi publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

ales On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
es He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 


22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. | 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the persondi cellphone 
numbers and email addresses from the files of the DCCC, 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0°s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated | 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 


27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
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soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Chery] Mills, dha 
Clinton aides, believe Ber deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald - 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe produser Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 


32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33; WikiLeaks continued to release John Podesta’s hacked emails hiet Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption lo - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met a spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE?’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 


35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
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Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks.' The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” | 

37, | On or about October 15, 2016, @RogerJ Stonele sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJ StoneJr containing a single word: “Happy?” 
@wikileaks immediately followed itp with another message less than a minute later: “We are 
now more free to communicate.” | 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 


accurate and authentic. The New York Times printed the Pentagon Papers which were 


l On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 


-10- 


Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 21 of 56 


indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual ai 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 


this forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with sronr and Others Regarding 
Forthcoming Leaks 


41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE’s eae) dress: October 


17, 2017, Chief Judge Howell issued a search warrant for one of STONE’s BRR 2d cresses, 


n or about December 19, 2017, Chief Judge Howell issued a search 


warrant for email account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. Onor about May 15, 2016 emited CORSI: “Here is my flight 
schedule. Need to get something confirmed now... .” CORSI responded, “I copied Roger 


Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
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appears to have forwarded the message to STONE 7 gg replied to 


CORSI that, “May meet Manafort -guarantee nothing.” 


43. On or about May 18, 2016, CORSI emailed STONE mr 


I believe that 


with the title, “Roger -- why don't you look this over before I send it t 
CORSI wrote, 
nd I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

44, On July 25, 2016, STONE, vin sent an email to 
CORSI with the subject line, “Get to Assange.” The body of the ee read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

45. On or about July 31, 2016, STONE, =Z ë 
CORSI with the subject line, “Call me MON.” The body of the email read: [E should see 
PERES = should find Bernie [S]anders brother who called Bill a Rapist — turn him for 
Trump].| ie should TO or more proof of Bill getting kicked out.” 

46. Onor about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

‘Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 


campaign to get serious starting Sept. Still in pre-season games, Time to let more than Podesta to 
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be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. Onor about August 5, 201 iz. associate of STONE’s, emailed 
STONE at D The email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” o sequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet ASSAN a g stated 
that in 201 7 Q STONE he would be interviewed by the FBI and would have to 
divulge the conversation about nest AS SANGE. STONE a.. was joking and 
had not actually met ASSANGE.? 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to p have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this afternoon[.]” The following day, the associate asked, 


“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 


T3 
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call later — heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

49, On or about August 15, 2016, CORSI emailed STONE at 


“Give me a call today if you can. Despite MSM drumroll that HRC is 


already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 
50. On or about August 31, 2016, CORSI emailed STONE at 


“Did you get the PODESTA writeup.” STONE replied “[y]es.” 


51. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6, 2016, CORSI emailed STONE at 


‘Roger[,] Is NY Post going to use the Pedesta [sic] stuff?” 


53. On or about September 24, 2016 A CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 


it again today.’ wrote back, “Awaiting secret file. Explosive... Hope you are well. 


Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators JM indicated this 


conversation concerned possible derogatory information he was trying to obtain from Turkey. 
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«$4, On or about October 3, 2016, an associate of STONE emailed STONE at 
Oo Q asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 

back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly fie knows what Assange has. I’d say that’s 
important.” 

55. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, ee 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. Onor about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE a “What was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and.the London police are standing done [sic].”, BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his lawyer ae : a big 


democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


FE. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. 


59. According to a publicly available news article,* at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fabrenfliclé received a uies call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

60. According to phone recor at approximately 
_ 11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. Atapproximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two = for 


approximately twenty minutes. 


i https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/31d74714-8ce5-11e6-875e-2c1bfe943b66_story.html 
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64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE sin i “T expect 


that much of next dump focus, setting stage for Foundation debacle.” 
66. At approximately an an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 
P| EN message to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 


G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 


numbers.” ` 


68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 


using TE cite Corsi asking him to “send me your best podesta links.” 


STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 


CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 


eh Ts 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it?s easy to understand will take weekend. Your choice?” 

69. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutės later with another email titled, “Podesta 
talking points,” with the text “sent a second iine just to be sure you got it.” STONE emailed 
CORSI back via the O “Got them and used them.” 

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at 

O DR -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “T’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like P| skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once E 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 


Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 


af 8 
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Russia & Metcombank{.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email ee the subject, “ROGER STONE article 
RUSSIAN MATIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger|,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money aia 00 a controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by O ie: the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with isiishie 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 


with the subject, “Fwd: 
ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yesf.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
_ they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off].]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead sar HAS once he’s duspned what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pls call. Important.” | 

77. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I siedioted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. Onor about November 8, 2016, the United States presidential election took place. 

79. — Onor about November 9, 2016, CORSI messaged STONE at his iCloud account, 


“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 


account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks i 


88. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. ... 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 


BER 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 


members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. | 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 

encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange, 

you were only referring to a single fact that you had confirmed with the intermediary — 

MR. STONE: That — 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. i 

90. Inthe month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. ... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE?’s Messaging to Randy CREDICO about STONE’s “Back channel” 

91, On or about November 19, 2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’........ Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 


the house committee lawyer told my lawyer that I will be getting a subpoena[.|” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
Sth Amendment rights if compelled to speak? They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them — which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I | 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. | STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017, Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. © On November 29, 2017, STONE publicly stated that CREDICO was his 


“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.]* You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth . .. You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 

_never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back . . . and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “rf 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee-you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” | 

98. STONE and CREDICO continued to message each other on or about December 1, 


2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 


4 Contrary to his statement, CREDICO had not provided any forensic evidence to the FBI. 
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STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. | On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs . . . + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102, CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee . . . But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 


lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 


Fa. 
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from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you start bringing up my dog, you’re crossing the line[.]’* 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.° In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 
He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 


have prostate cancer and did not have any such discussion with STONE. 


K. The Target Server and STONE’s Efforts to Remove Documents and Information 
from his Residence 


105. On or about Friday, May 18, w F assistant to STONE, was 
voluntarily interviewed by investigators from the Special Counsel’s Office. — g 
investigators that he became STONE’s assistant in Florida in 2015, and that during the summer 
of 2016, he acted as STONE’s right-hand man. o g investigators, in substance and 
in part, that STONE was scared about getting hacked and scared about the government 
“snooping” on him, and that STONE was inthe process of hardening his home systems and 
trying to move things off his desktop computer to a secure server TT corther advised 
that STONE had a new “tech guy” assisting him. 

106. o= g the FBI that as part of this process, STONE was encrypting his 


data but not deleting it. Analysis of STONE’s iCloud, which was searched pursuant to a warrant 


> https://www.yahoo.com/news/comedian-randy-credico-says-trump- adviser-roger-stone- 
threatened-dog-135911370.html 


é https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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issued by Chief Judge Howell on or about August 3, 2018, nonetheless indicates that call logs 
and chats occurring prior to March 1, 2018 have been deleted. Call logs and/or chats from 
certain additional periods of time (for example, June 29, 2018 to July 13, 2018) also appear to 
have been deleted. To date, the FBI has not been able to determine when those deletions 
occurred. | 
107. On or about May 22,2013 who provided tech services for 
STONE’s iMacs, was voluntarily interviewed by the FBI by telephone (having previously been 
interviewed in person). a stated that STONE’s wife had hired someone else to set up an 
offsite remote server for data at their Fort Lauderdale residence. a identified the individual 
- who set up the server as | Freestyle Systems, whom iinet in person at 
STONE’s house in early April. EER that STONE was concerned with his business 
and work if his computers were seized and he did not have access to them, and he wanted to be 
able to continue to work, write, and get the word out in that event. KARI that he believed 
that the remote server is hosted by Liquid Web and that STONE pays approximately $500 per 
month for it. 
108. Based on open source information, I know that Liquid Web, LLC is a U.S. 
provider offering dedicated servers, VPS hosting, and cloud servers with Linux or Windows. 
o government obtained subscriber records from Liquid 
Web for an account opened S hose records show that on or about March 27, 2018, 
O] purchased a server described as “Item: DS.1230v5 - Dedicated Server - Single Intel Xeon 
CPU - US Central Zone” for $324 per month (“Target Server”). On or about the same day, a 
new inventory entry was made in the Liquid Web system, reading “New entry in inventory 


[223605:2869647]: description: <b>host.rogerstone.com::DS.1230v5</b>, owner_rel_id: 
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<b>3475479</b>.” In my training and experience, this indicates that the server purchased by 


O E a E to public WHOIS records, the domain 


109. According to records obtained from Liquid Web, the name of the Target Server 
was changed G o Q or about March 28, 2018. The Target Server was 
assigned the IP dares Based on a search conducted on shodan.io, a specialized 
search engine that scans information about all devices connected to the Internet, the Target 


Server’s configuration has not been changed since March 28, 2018. 


110. According to communications produced by eee 
P| on or about March 27, 2018—the same day that E leased the Target 


Server—STONE’s wife texte fT Would you be willing to speak to P| who has 


setting [sic] up a hosted server for Rogers computer? ....All of Rogers data is still on his 
desktop but because of his issues with government agencies and after a total backup of his 
system and a forensic audit of all the emails and documents on his computer it was concluded 
that all future information would be safer on an outside server. . . .” 

111. Onor about April 9, 201 ym STONE an email at 

ith the subject, “Remote server update.” In that omail, GR 

“After finding out he couldn’t wipe the data from your drives 1 oe IT guy) 
wanted us to buy new hard drives and replace the drives on your iMac (and have [Stone’s 
attorney] put them away in safety deposit box).” es: told STONE that, if the data 
was migrated onto a server that runs Windows (which the Target Server does), “Ib]oth 
iMacs . . . would need to be put somewhere out of the house/apt to accomplish ‘getting data out 


of the house.’” 
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112. o : April 9, 2018 email suggests that, at the im è g not 
understand thal had already stood up a server for STONE. In substance fi 


recommended against the use of a remote Windows server, and asked STONE to “[l]et me know 


if you want to stay put, or go to windows server i ii 


113. According to communications provided ~~ © the FBI, on or about April 


25, 2018, nn: “I just got a call from E and it appears Roger is going 
~ forward with the server idea.” When ë sie | exactly” vas 


doing GG “Synchronizing the files to the server... .” 

114. Based on the foregoing, and my training and experience, there is probable to 
-~ cause to believe that the Liquid Web remote server with IP addres i i.e., the Target 
Server, is a dedicated server used by, and set up on behalf of, STONE, and that the Target 
Server contains evidence, fruits, and/or instrumentalities of the Subject Offenses. 

BACKGROUND CONCERNING LIQUID WEB 

115. Based on open source information, I know that Liquid Web, LLC, which hosts the 
Target Server, is a company based in Lansing, Michigan, which offers dedicated servers, VPS 
hosting, and cloud servers with Linux or Windows. The Target Server is among a number of 
VPSs running on physical servers controlled by Liquid Web. According to public WHOIS data, 
the Target Server is located in Lansing, Michigan. 

116. Based on my knowledge, training, and experience, I know that computer files or 
remnants of such files can be recovered months or even years after they have been downloaded 
onto a storage medium, deleted, or viewed via the Internet. Electronic files downloaded to a 
storage medium can be stored for years at little or no cost. Even when files have been deleted, 


they can be recovered months or years later using forensic tools. This is so because when a person 
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“deletes” a file on a computer, the data contained in the file does not actually disappear; rather, 
that data remains on the storage medium until it is overwritten by new data. 

117. Therefore deleted files, or remnants of deleted files, may reside in free space or 
slack space — that is, in space on the storage medium that is not currently being used by an active 
file —for long periods of time before they are overwritten. In addition, a computer’s operating 
system may also keep a record of deleted data in a “swap” or “recovery” file. 

118. Wholly apart from user-generated files, computer storage media contain electronic 
evidence of how a computer has been used, what it has been used for, and who has used it. To 
give a few examples, this forensic evidence can take the form of operating system configurations, 
artifacts from operating system or application operation, file system data structures, and virtual 
memory “swap” or paging files. Computer users typically do not erase or delete this evidence, 
because special software is typically required for that task. However, it is technically possible to 
delete this information. 

119. Similarly, files that have been viewed via the Internet are sometimes automatically 
downloaded into a temporary Internet directory or “cache.” The browser often maintains a fixed 
amount of hard drive space devoted to these files, and the files are only overwritten as they a 
replaced with more recently viewed Internet pages or if a user takes steps to delete them. 

120. As further described in Attachment B, this application seeks permission to locate 
not only the computer files that might serve as fruits and instrumentalities or the crimes described 
in the warrant, but also for evidence, also described in Attachment B, that established w 
computers were used, the purpose of their use, who used them, and when. 

121. Data on the storage medium not currently associated with any file can provide 


evidence of a file that was once on the storage medium but has since been deleted or edited, or of 


Ba 
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a deleted portion of a file (such as a paragraph that has been deleted from a word processing file). 
Virtual memory paging systems can leave traces of information on the storage medium that show 
what tasks and processes were recently active. Web browsers, email programs, and chat programs 
store configuration information on the storage medium that can reveal information such as online 
nicknames and passwords. Operating systetus can record additional information, such as the times 
the computer was in use. Computer file systems can record information about the dates files were 
created and sequence in which they were created. 

122. Forensic evidence on a computer can also indicate who has used or controlled the 
computer. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, registry information, configuration 
files, user profiles, email, email address books, “chat,” instant messaging logs, photographs, and 
correspondence (and the data associated with the foregoing, such as file creation and last accessed 
dates) may be evidence of who used or controlled the computer at a relevant time. 

123. A person with appropriate familiarity with how a computer works can, after 
examining this forensic evidence in its proper context, draw conclusions about how computers 
were used, the purpose of their use, who used them, and when. 

124. The process of identifying the exact files, blocks, registry entries, logs, e other 
forms of forensic evidence on a storage medium that are necessary to draw a accurate conclusion 
is a dynamic process. While it is possible to specify in advance with particularity a description of 
the records sought, evidence of this type is not always data that can be merely reviewed by a review 
team and passed along to investigators. Whether data stored on a computer is evidence may 
depend on other information stored on the computer and the application of knowledge about how 


a computer behaves. 


33. 
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125. The FBI anticipates executing this warrant under the above-cited ECPA provisions 
by using the search warrant to compel Liquid Web to provide a copy of the Target Server, 
including a copy of the memory used by the Target Server. Generally speaking, this copy 
duplicates every bit and byte on the Target Server, including all files, slack space, Master File 
Table, and metadata in exactly the ordcr they appear on the original; in order words, the taking of 
a complete electronic picture of the computer’s data, including all hidden sectors deleted files, and 
memory. In my training and experience, the data associated with the Target Server, including 
artifacts such as slack space and deleted files, are segregated as part of the Target Server and can 
be imaged separately from other VPSs that may be stored on the same physical server. After 
obtaining a copy of the Target Server, FBI agents or their experts will review that information to 
locate the items described in Section II of Attachment B. 

126. This application seeks a warrant to search all responsive records and information 
under the control of Liquid Web, a provider subject to the jurisdiction of the Court, regardless of 
where Liquid Web has chosen to store such information. The government intends to require, 
pursuant to the warrant, the disclosure of the contents of wire or electronic communications and 
any records of other information pertaining to the customers or subscribers if such communication, 
records, or other information is within Liquid Web’s possession, custody, or control, regardless of 
where that information is stored. 

127. As noted above MA cia the FBI that, in connection with STONE’s efforts 
to move material off his desktop to a secure server, STONE was encrypting data. Accordingly, it 
is possible that part or all of the data on the Target Server is encrypted. In my training and 
experience, I know that if the FBI obtains a forensic copy of the undisturbed contents of random 


access memory of the running Target Server, which is sought in this application, it may be 
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possible to carve data to locate the encryption password. If this application is granted and the 
server is, in fact, encrypted, the FBI intends to use that process to locate the password through 
forensic means, and to use the password to access the server in execution of the warrant. 
FILTER REVIEW PROCEDURES 

128. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential itera 

CONCLUSION 
129. Based on the forgoing, I request that the Court issue the proposed search warrant. 
130. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 


required for the service or execution of this warrant. 
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REQUEST FOR SEALING 


131. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 

ie n 
Patrick J. Myers p 

Special Agent 


Federal Bureau of Investigation 


y, 1 
Subscribed and sworn to before me on this 2 g~ of September, 2018. 


. The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to the virtual private server using the IP address set forth below, which 
is controlled and/or operated by Liquid Web, LLC, a company headquartered in Lansing, 


Michigan: 
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ATTACHMENT B 
I. Information to be disclosed by Liquid Web LLC 
To the extent that the information described in Attachment A is within the possession, 
custody, or control of Liquid Web LLC (hereinafter, “the Provider”), regardless of where such 
information is stored, held or maintained, the Provider is required to disclose the following 
information to the government for the server listed in Attachment A (“Target Server”): 

a. A forensic copy of the contents of the Target Server described in Attachment A; 
information pertaining to the tool and process used to create said forensic copy; a 
log of the process; verification of the process; a record of who created the copy, 
when it was created, and where it was created, including the person’s name, title, 
contact numbers, and address; 

b. A forensic copy of the undisturbed contents of random access memory of the 
running Target Server described in Attachment A; information pertaining to the tool 
and process used to create said forensic copy; a log of the process; verification of 
the process; a record of who created the copy, when it was created, and where it 
was created, including the person’s name, title, contact numbers, and address; 

c. All records of other subscriber information regarding the account, to include ufll 
name, physical address, telephone numbers and other identifiers, records of session 
times and durations, the date on which the account was created, the length of 
service, the types of services utilized, the IP address used to register the account, 
login-in IP addresses associated with session times and dates, account status, 


alternative email addresses provided during registration, methods of connection, 


5. 
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log files, and means and source of payment (including any credit or bank account 


numbers); 


. All records pertaining to communications between the Provider and any person 


regarding the account, including contacts with support services and records of 


actions taken. 


Ii. information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A. 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2015 to the present, including: 


a. 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, a Julian 
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individual associated with the Trump Campaign, or any witness in the 
investigation; 

Č. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed e 

f; Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronolo gical context of account access, use, and events relating 


to the crimes under investigation and to the account owner; 


h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 
i. The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 
j. Credit card and other financial information, including but not limited to, bills and 


payment records evidencing ownership of the subject account; 


-4- 


Case 1:19-mc-00029-CRC Document 29-22 Filed 04/28/20 Page 51 of 56 


k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage wbich concern the categories identified 
in subsection II.a. 

HI. - Review Protocols 

Review of the items desorbed 3 in Amuma A and Attachment B shall be conducted 
pursuant to established procedures designed to gied evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OT (OT TR ADTA 


Case: 1:18-sc-—02881 


IN THE MATTER OF THE SEARCH OF (Assigned To : Howell, Beryl A 
INFORMATION ASSOCIATED WITH ONE Assign. Date : 9/24/2018 
VIRTUAL PRIVATE SERVER l Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 


TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 


moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”).under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non- 
disclosure, the proposed Order would direct Liquid Web, LLC (“Liquid Web”), an electronic 
communication and/or remote computing services provider headquartered in Lansing, Michigan, 
not to notify any other person (except attorneys for Liquid Web for the purpose of receiving legal 


advice) of the existence or content of the Warrant for a period of one year or until further order of 


the Court. 
JURISDICTION AND LEGAL BACKGROUND 
1. The Court has the inherent power to seal court filings when appropriate, 


including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v, Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2, In addition, this Court has jurisdiction to issue the requested arder because it is “a 


court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
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“district court of the United States . . . that — has jurisdiction over the offense being investigated.” 
18 U.S.C. § 2711()(A)G@). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3; Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Liquid Web provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Liquid Web may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(1)(A) allows the 
. Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4, The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 
notification. In relevant part, Section 2705(b) provides as follows:! 

(b) Preclusion of notice to subject of governmental access. — A governmental 

entity acting under section 2703 . . . may apply to a court for an order commanding 

a provider of electronic communications service or remote computing service to 

whom a warrant, subpoena, or court order is directed, for such period as the court 

deems appropriate, not to notify any other person of the existence of the warrant, 

subpoena, or court order. The court shall enter such an order if it determines that 


there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 


' Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 

(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 


18 U.S.C..§ 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 
requisite showing about potential consequences of notification: 
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 


government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 


In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ201403 1422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5, Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Liquid Web not to notify any _— person (except attorneys for Liquid Web for the 
purpose of receiving legal advice) of the existence of the Subpoena for a period of one year or until 
further order of the Court. 


FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S.C. 
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a 
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent), 
_18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 ef seq. 
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject 


Offenses”), in connection with efforts to compromise the networks of the Democratic National 
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Convention (“DNC”), the Democratic Congressional Campaign Committee (“DCCC”), and the 
email accounts of U.S. persons involved in the 2016 presidential election, followed by the public 
release of stolen materials through various outlets. 

hh In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Liquid Web and its employees be directed not to notify any other person of 
the existence or content of the Warrant (except attorneys for Liquid Web for the purpose of 
receiving legal advice) for a period of one year or until further order of the Court. Such an order 
is appropriate because the Warrant relates to an ongoing criminal investigation, the scope and 
nature of which is neither public nor known to the targets of the investigation, and its disclosure 
may alert these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of 
the Warrant and related papers may also alert the targets to the scope of information known to the 
FBI. Once alerted to this information, potential targets would be immediately prompted to destroy 
or conceal incriminating evidence, alter their operational tactics to avoid future detection, and 
otherwise take steps to undermine the investigation and avoid future prosecution. In particular, 
given that they are known to use electronic communication and remote computing services, the 
potential target could quickly and easily destroy or encrypt digital evidence relating to their 
criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme Ha be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 


longer needed, the Government will notify the Court and seek appropriate relief. 
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9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an AE 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
compclling governmental interest in confidentiality lo justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Liquid Web, the United States is aware that, absent a 
court order under Section 2705(b) commanding Liquid Web not to notify anyone about a legal 
request, Liquid Web may, upon receipt of a warrant seeking the contents of electronically stored 
wire or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the en sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Liquid Web not to notify any other person of the existence or contents of the above-captioned 
warrant (except attorneys for Liquid Web for the purpose of receiving legal advice) for a period of 
one year or until further order of the Court. 


Respectfully submitted, 


ROBERT S. MUELLER, III 
Special Couns 


Dated: ZAANP 


(202) 616-3812 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 


District of Columbia 


: m in eit of ue ies A : Case: 1:18-sc—02905 
(Briefly describe the property to be searche Assigned To : Howell, Beryl A. 


or identify the person by name and address) i 
INFORMATION ASSOCIATED WITH ONE ACCOUNT ABANT Date: 9/20/2018 
STORED AT PREMISES Description: Search & Seizure Warrant 
CONTROLLED BY TWITTER ) 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 


of the following person or property located in the _ Northern District of _ California 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before October 9, 2018 (not to exceed 14 days) 
MM in the daytime 6:00 a.m. to 10:00 p.m. O at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to _ Hon. Beryl A. Howell, Chief U.S. District Judge 
(United States Magistrate Judge) 


Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

QO for days (not to exceed 30) O until, the facts justifying, the later specific date of 


ate aid time iset Z VL "=f Pot J, col) Est ft Wea 


Judge's signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 


Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 3 of 59 


ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Twitter accounts, which 
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. (“Twitter”), a 


company headquartered in San Francisco, California: 


I. 
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ATTACHMENT B 
Information to be disclosed by Twitter 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Twitter, Inc. (“Twitter”), including any messages, records, files, logs, or 


information that have been deleted but are still available to Twitter, or have been preserved 


pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following 


information to the government for each account listed in Attachment A: 


A, 


All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the account, 
and all photographs or images included in those Tweets and Direct Messages; 


The content of all communications (public or private) sent to or from, stored in draft form 
in, or otherwise associated with the account, including the content of all messages, 
attachments, and header information; 


All data and information associated with the profile page, including photographs, “bios,” 
and profile backgrounds and themes; 


All other content associated with the account, including, but not limited to, posts, 
documents, spreadsheets, photos, and videos; 


All information from the "Connect" tab for the account, including all lists of Twitter users 
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets 
that include the username associated with the account (i.e., “mentions” or “replies”); 


All photographs and images in the user gallery for the account; 


All location data associated with the account, including all information collected by the 
“Tweet With Location” service; 


All information about the account's use of Twitter’s link service, including all longer 
website links that were shortened by the service, all resulting shortened links, and all 
information about the number of times that a link posted by the account was clicked; 


All data and information that has been deleted by the user; 


A list of all of the people that the user follows on Twitter and all people who are following 
the user (i.e., the user’s “following” list and “followers” list); 


A list of all users that the account has “unfollowed” or blocked; 
All “lists” created by the account; 


BA 
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All information on the “Who to Follow” list for the account; 
All privacy and account settings; 


All records of Twitter searches performed by the account, including all past searches saved 
by the account; 


All current and historical subscriber and payment information, including full name, e-mail 
address (including any secondary or recovery email addresses), physical address (including 
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number, 
websites, screen names, user identification numbers, security questions and answers, 
registration IP address, payment history, and other personal identifiers; 


All email addresses and telephone numbers ever registered (whether successfully or not) 
to the account, including dates of any changes and the IP addresses used for any changes; 


All past and current usernames, account passwords, and names associated with the account, 
including dates of any changes and the IP addresses used for any changes; 


All data and information associated with the profile page, including photographs; 


All advertising data relating to the account, including, but not limited to, information 
regarding unique advertising IDs associated with the user, any devices used to access the 
account, application IDs, UDIDs, payment information (including, but not limited to, full 
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads 
created; 


The dates and times at which the account and profile were created, and the Internet Protocol 
(“IP”) address at the time of sign-up; 


All transactional records associated with the account, including any IP logs or other records 
of session times and durations; 


Any information identifying the device or devices used to access the account, including a 
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers, 
MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers 
(“MEIN”), Mobile Equipment Identifiers (‘MEID”), Mobile Identification Numbers 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services 
Digital Network Number (“MSISDN”), International Mobile Subscriber Identifiers 
(“IMST”), or International Mobile Equipment Identities (‘IMEI’), and any other 
information regarding the types of devices used to access the account; 


All activity logs for the account; 


All location information for the account, including all location data collected by any 
plugins or widgets; 


The types of service utilized by the user; 


B 
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AA.  Allinformation about the account’s use of Twitter’s link service, including all website links 
embedded in, exporting data to, or importing data from, the account’s website or blog; 


BB. All full website links that were shortened by Twitter’s link service, all resulting shortened 
links, and all information about the number of times that a link posted by the account was 
clicked; 


CC. All information about connections between the account and third-party websites and 
applications, including any Twitter, Facebook or other social networking accounts to which 
posts from the account are sent; 


DD. All data and information that has been deleted by the user; 


EE. The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 


FF. All privacy settings and other account settings, including email addresses or other accounts 
that the account has blocked; 


GG. Information regarding linked accounts, including accounts linked by cookie, IP address 
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie 


ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device 
identifier, or any other account or device identifier; 


HH. Information regarding accounts linked to accounts to which the Target Accounts are linked; 
I. All records pertaining to communications between the Service Provider and any person 
regarding the user or the user’s account with the Service Provider, including contacts with 
support services, records of actions taken, and investigative or user complaints concerning 
the subscriber. 
TI. Information to be Seized by the Government 
Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from March 1, 2016 to the present, including: 
As 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome orsi Julian 


individual associated with the Trump Campaign, or any witness in the 
investigation; 

A Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 


to the crimes under investigation and to the account owner; 


h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 
i. The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 

J Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

Í; The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)— including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

Os All existing printouts from original storage which concern the categories identified 


in subsection Il.a. 


sis 
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III. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 


zo 
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AO 106 (Rev. 04/10) Application tor a Search Warrant 


UNITED STATES DISTRICT COURT FILLED 
for the ind 
District of Columbia SEP 2 6 2018 


Clerk, U.S. District & Bankruptcy 
aut fe ino Olstiet of Golumbla 
Case: 1:18-sc-02905 
Assigned To : Howell, Beryl A. 
Assign. Date : 9/26/2018 
Description: Search & Seizure Warrant 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 
INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED 


BY TWITTER 


ee 


APPLICATION FOR A SEARCH WARRANT 
I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 


penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 
located in the Northern District of _ California 


person or describe the property to be seized): 


See Attachment B 


_ , there is now concealed (identify the 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 


im evidence of a crime; 

wm contraband, fruits of crime, or other items illegally possessed; 

& property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
52 U.S.C. § 30121 Foreign Contribution Ban 
18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 
The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 
O Delayed notice of days (give exact ending date if more than 30 days: 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


__ ) is requested 


-S 


Reviewed by AUSA/SAUSA: Applicant's signature 
Kyle R. Freeny (ASC) Patrick J. Myers, Special Agent, FBI 7 
Printed name and title 


Sworn to before me and signed in my presence. 


Date: PRLE Lat. Aore 


Judge's signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 
Printed name and title 


City and state: Washington, D.C. 
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crs eR 
rick the 


RE 


SEP 2 6 2018 
IN THE UNITED STATES DISTRICT COURT 


Clerk, U.S. Dist : 
FOR THE DISTRICT OF COLUMBIA ene, PANO 


Courts for the District of Columbla 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH Assigned To : Howell Beryl A 
ONE ACCOUNT STORED AT PREMISES ; d 


D. Assign. Date : 9/26/2018 
CONTROLLED BY TWI ri ER, INC. Description: Search & Seizure Warrant 


Case: 1:18-sc-02905 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 


L, I make this affidavit in support of an application for a search warrant for 


information associated with the Twitter account 


which is 


stored at premises owned, maintained, controlled or operated by Twitter, Inc. (“Twitter”), a 


company headquartered in San Francisco, California. 


Upon receipt of the information described in Attachment A, government-authorized persons will 
review that information to locate the items described in Attachment B. 

sA I am a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 
3. The facts in this affidavit come from my personal observations, my training and 


experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
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intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5: This Court has jurisdiction to issue the requested warrant because it is “a court of 

competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 
(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 
PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 
6. Roger STONE is a self-employed political strategist/consultant and has been 


actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
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Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii. Jerome CORSI 

‘7 Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 


contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9, On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 


and maintained that access until at least June 2016.” The USIC attributed these cyber activities 


to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 


ihe 
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in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

i, With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

I7; On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 


elections in numerous Florida counties. 


ESA 
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18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 
C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 


22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. 1 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 


2T: On August 21, 2016, using @RogerJStoneJr, STONE tweeted: “Trust me, it will 


Er 
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soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Chery] Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 


32. | Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 


ie 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

ah WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since J never communicated with WikiLeaks, I guess J must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 


35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 


mee 
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Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks.' The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 


accurate and authentic. The New York Times printed the Pentagon Papers which were 


l On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 


this forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with sTonr and Others Regarding 
Forthcoming Leaks 


41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for stones address; 


17, 2017, Chief Judge Howell issued a search warrant for one of STONE’ s addresses, 
On or about December 19, 2017, Chief Judge Howell issued a search 
warrant for mail account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 
42.  Onor about May 15, 0 emailed CORSI: “Here is my flight 


schedule. Need to get something confirmed now ... .” CORSI responded, “I copied Roger 


Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
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appears to have forwarded the message to STONE hy g replied to 


CORSI that, “May meet Manafort -guarantee nothing.” 


43. On or about May 18, 2016, CORSI emailed STONE i 


with the title, “Roger -- why don't you look this over before I send it i believe that 


ee 
0o ER I did manage to see Mr. Trump for a few minutes today as we were 


waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 


was very cordial. He would look for this memo from you this afternoon.” 

44. On July 25, 2016, STONE, D 0: an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
{a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 


Foundation, allegedly.” 


45. On or about July 31, 2016, STONE, usin emailed 


CORSI with the subject line, “Call me MON.” The body of the email read: should see 
Assange[.] sz should find Bernie [SJanders brother who called Bill a Rapist — turn him for 
Trump RE shout find or more proof of Bill getting kicked out.” 

46. Onor about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

Sa “Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 


for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 


campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
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be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47.  Onor about August 5, 206 Q associate of STONE's, emailed 
STONE SO The email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” | stated to investigators that, around the 
same time, STONE told him he had gone to London to meet assance MM ts0 stated 
that in 201 , g STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE i: was joking and 
had not actually met ASSANGE.? 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to Sa to have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this afternoon[.]” The following day, the associate asked, 


“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
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call later — heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 


49. On or about August 15, 2016, CORSI emailed STONE at 


‘Give me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. On or about August 31, 2016, CORSI emailed STONE at 


‘Did you get the PODESTA writeup.” STONE replied “[y]es.” 


51. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6, 2016, CORSI emailed STONE at 
O Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24, 2016 Q CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 


it again today.” R back, “Awaiting secret file. Explosive... Hope you are well. 


Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 


about file[.]” In a subsequent meeting with Deru indicated this 


conversation concerned possible derogatory information he was trying to obtain from Turkey. 
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54. On or about October 3, 2016, an associate of STONE emailed STONE at 
lo and asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 

back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the A Ee at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange ki Pd say that’s 
important.” 

55. Onor about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents oi various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE T was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his lawyer J is a big 


democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. 


59. According to a publicly available news article,’ at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

60. According to phone records ie a at approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 


approximately twenty minutes. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 1d74714-8ce5-1 1e6-875e-2c1 bfe943b66_ story. htm! 
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64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE UU “T expect 


that much of next dump focus, setting stage for Foundation debacle.” 
66. At approximately 27 an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 
i _ "or warde ia message to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 


G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


67. Onor about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 

68. | Onor about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
usin emailed Corsi asking him to “send me your best podesta links.” 
STONE emaile at approximately 8:44AM EDT, “need your BEST podesta pieces.” 


CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 

Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 
69. On or about that same day, October 12, 2016, Podesta accused STONE of having 

advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 


line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 


emailed STONE at both 


podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via ine Account, “Got them and used them.” 

Ti On or about Thursday, October 13, 2016, CORSI emailed STONE at 

= KA -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “Pll give you one more — NOBODY YET HAS THIS[:] It looks to me 
ike | skimmed maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] once 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 


Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 


al 8- 


Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 29 of 59 


Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email hi g the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did as a controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent i with the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 


ee sean 
T EN Loo wrote, “From a very trusted source,” and forwarded an email 


with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off].]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pls call. Important.” 

Th On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 


“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts... .. 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. . . . 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who J knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 

encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange, 

you were only referring to a single fact that you had confirmed with the intermediary — 

MR. STONE: That — 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’........ Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 


the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 


aa 
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back, “That was the point at which your lawyers should have told them you would assert your 
Sth Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them — which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. | STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 


“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 
content of the material.” 

97: On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.]* You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth .. . You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back .. . and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testiffy[.]” 

98. | STONE and CREDICO continued to message each other on or about December 1, 


2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 


* Contrary to his statement, CREDICO had not provided any forensic evidence to the FBI. 
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STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs ...+ 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee . . . But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 


lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
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from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
. . When you start bringing up my dog, you’ re crossing the line[.]’° 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.°® In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 


He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 


have prostate cancer and did not have any such discussion with STONE. 


K. The Target Account 


> https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 
é https://www.motherjones.com/politics/20 1 8/05/roger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERNING TWITTER 


110. Twitter owns and operates a free-access social-networking website of the same 


name that can be accessed at http://www.twitter.com. Twitter allows its users to create their own 
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profile pages, which can include a short biography, a photo of themselves, and location 
information. Twitter also permits users create and read 140-character messages called “Tweets,” 
and to restrict their “Tweets” to individuals whom they approve. These features are described in 
more detail below. 

111. Upon creating a Twitter account, a Twitter user must create a unique Twitter 
username and an account password, and the user may also select a different name of 20 
characters or fewer to identify his or her Twitter account. The Twitter user may also change this 
username, password, and name without having to open a new Twitter account. 

112. Twitter asks users to provide basic identity and contact information, either during 
the registration process or thereafter. This information may include the user’s full name, e-mail 
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown, 
occupation, and other personal identifiers. For each user, Twitter may rétain information about 
the date and time at which the user’s profile was created, the date and time at which the account 
was created, and the Internet Protocol (“IP”) address at the time of sign-up. Because every 
device that connects to the Internet must use an IP address, IP address information can help to 
identify which computers or other devices were used to access a given Twitter account. 

113. A Twitter user can post a personal photograph or image (also known as an 
“avatar”) to his or her profile, and can also change the profile background or theme for his or her 
account page. In addition, Twitter users can post “bios” of 160 characters or fewer to their profile 
pages. 

114. Twitter also keeps IP logs for each user. These logs contain information about the 
user’s logins to Twitter including, for each access, the IP address assigned to the user and the 


date stamp at the time the user accessed his or her profile. 
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115. As discussed above, Twitter users can use their Twitter accounts to post “Tweets 
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was 
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posted to Twitter. Twitter users can also “favorite,” “retweet,” or reply to the Tweets of other 
users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign, 
Twitter designates that Tweet a “mention” of the identified user. In the “Connect” tab for each 
account, Twitter provides the user with a list of other users who have “favorited” or “retweeted” 
the user’s own Tweets, as well as a list of all Tweets that include the user’s username (i.e., a list 
of all “mentions” and “replies” for that username). 

116. Twitter users can include photographs or images in their Tweets. Each Twitter 
account also is provided a user gallery that includes images that the user has shared on Twitter, 
including images uploaded by other services. 

117. Twitter users can also opt to include location data in their Tweets, which will 
reveal the users’ locations at the time they post each Tweet. This “Tweet With Location” 
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users 
may delete their past location data. 

118. When Twitter users want to post a Tweet that includes a link to a website, they 
can use Twitter’s link service, which converts the longer website link into a shortened link that 
begins with http://t.co. This link service measures how many times a link has been clicked. 

119. A Twitter user can “follow” other Twitter users, which means subscribing to 
those users’ Tweets and site updates. Each user profile page includes a list of the people who are 
following that user (i.e., the user’s “followers” list) and a list of people whom that user follows 
(i.e., the user’s “following” list). Twitters users can “unfollow” users whom they previously 


followed, and they can also adjust the privacy settings for their profile so that their Tweets are 
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visible only to the people whom they approve, rather than to the public (which is the default 
setting). A Twitter user can also group other Twitter users into “lists” that display on the right 
side of the user’s home page on Twitter. Twitter also provides users with a list of “Who to 
Follow,” which includes a few recommendations of Twitter accounts that the user may find 
interesting, based on the types of accounts that the user is already following and who those 
people follow. 

120. In addition to posting Tweets, a Twitter user can also send Direct Messages 
(DMs) to one of his or her followers. These messages are typically visible only to the sender and 
the recipient, and both the sender and the recipient have the power to delete the message from the 
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a 
particular user, but older DMs are stored on Twitter’s database. 

121. Twitter users can configure the settings for their Twitter accounts in numerous 
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the 
user’s mobile phone, and the user can also set up a “sleep time” during which Twitter updates 
will not be sent to the user’s phone. 

122. Twitter includes a search function that enables its users to search all public 
Tweets for keywords, usernames, or subject, among other things. A Twitter user may save up to 
25 past searches. 

123. Twitter users can connect their Twitter accounts to third-party websites and 
applications, which may grant these websites and applications access to the users’ public Twitter 
profiles. 

124. Ifa Twitter user does not want to interact with another user on Twitter, the first 


user can “block” the second user from following his or her account. 
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125. In some cases, Twitter users may communicate directly with Twitter about issues 
relating to their account, such as technical problems or complaints. Social-networking providers 
like Twitter typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. Twitter may also suspend a particular user 
for breaching Twitter’s terms of service, during which time the Twitter user will be prevented 
from using Twitter’s services. 

126. As explained herein, information stored in connection with a Twitter account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Twitter user’s account information, IP log, stored electronic communications, and other data 
retained by Twitter, can indicate who has used or controlled the Twitter account. This “user 
attribution” evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence. For example, profile contact information, communications, 
“tweets” (status updates) and “tweeted” photos (and the data associated with the foregoing, such 
as date and time) may be evidence of who used or controlled the Twitter account at a relevant 
time. Further, Twitter account activity can show how and when the account was accessed or 
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from 
which users access their accounts along with the time and date. By determining the physical 
location associated with the logged IP addresses, investigators can understand the chronological 
and geographic context of the account access and use relating tw the crime under investigation. 


Such information allows investigators to understand the geographic and chronological context of 
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Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter 
builds geo-location into some of its services. If enabled by the user, physical location is 
automatically added to “tweeted” communications. This geographic and timeline information 
may tend to either inculpate or exculpate the Twitter account owner. Last, Twitter account 
activity may provide relevant insight into the Twitter account owner’s state of mind as it relates 
to the offense under investigation. For example, information on the Twitter account may 
indicate the owner’s motive and intent to commit a crime (e.g., information indicating a criminal 
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal 
evidence from law enforcement). 

127. Therefore, the computers of Twitter are likely to contain all the material described 
above, including stored electronic communications and information concerning subscribers and 
their use of Twitter, such as account access information, transaction information, and other account 
information. 

FILTER REVIEW PROCEDURES 

128. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 
129. Based on the forgoing, I request that the Court issue the proposed search warrant. 
130. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 


required for the service or execution of this warrant. 
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REQUEST FOR SEALING 
131. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


“eee J. Myers 


Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this HY of September, 2018. 


fxca thee 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Twitter accounts, which 
are stored at premises owned, maintained, controlled, or operated by Twitter, Inc. (“Twitter”), a 


company headquartered in San Francisco, California: 
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ATTACHMENT B 
I. Information to be disclosed by Twitter 
To the extent that the information described in Attachment A is within the possession, 
custody, or control of Twitter, Inc. (“Twitter”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Twitter, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following 
information to the government for each account listed in Attachment A: 


A. All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the account, 
and all photographs or images included in those Tweets and Direct Messages; 


B. The content of all communications (public or private) sent to or from, stored in draft form 
in, or otherwise associated with the account, including the content of all messages, 
attachments, and header information; 


Cc All data and information associated with the profile page, including photographs, “bios,” 
and profile backgrounds and themes; 


D. All other content associated with the account, including, but not limited to, posts, 
documents, spreadsheets, photos, and videos; 


E. All information from the "Connect" tab for the account, including all lists of Twitter users 
who have favorited or retweeted Tweets posted by the account, as well as a list ofall Tweets 
that include the username associated with the account (i.e., “mentions” or “replies”); 


F, All photographs and images in the user gallery for the account; 


G. All location data associated with the account, including all information collected by the 
“Tweet With Location” service; 


H. All information about the account's use of Twitter’s link service, including all longer 
website links that were shortened by the service, all resulting shortened links, and all 
information about the number of times that a link posted by the account was clicked; 


I: All data and information that has been deleted by the user; 


Jy A list ofall of the people that the user follows on Twitter and all people who are following 
the user (i.e., the user’s “following” list and “followers” list); 


K. A list of all users that the account has “unfollowed” or blocked; 
All “lists” created by the account; 
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All information on the “Who to Follow” list for the account; 
All privacy and account settings; 


All records of Twitter searches performed by the account, including all past searches saved 
by the account; 


All current and historical subscriber and payment information, including full name, e-mail 
address (including any secondary or recovery email addresses), physical address (including 
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number, 
websites, screen names, user identification numbers, security questions and answers, 
registration IP address, payment history, and other personal identifiers; 


All email addresses and telephone numbers ever registered (whether successfully or not) 
to the account, including dates of any changes and the IP addresses used for any changes; 


All past and current usernames, account passwords, and names associated with the account, 
including dates of any changes and the IP addresses used for any changes; 


All data and information associated with the profile page, including photographs; 


All advertising data relating to the account, including, but not limited to, information 
regarding unique advertising IDs associated with the user, any devices used to access the 
account, application IDs, UDIDs, payment information (including, but not limited to, full 
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads 
created; 


The dates and times at which the account and profile were created, and the Internet Protocol 
(“IP”) address at the time of sign-up; 


All transactional records associated with the account, including any IP logs or other records 
of session times and durations; 


Any information identifying the device or devices used to access the account, including a 
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers, 
MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers 
(“MEIN”), Mobile Equipment Identifiers (““MEID”), Mobile Identification Numbers 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services 
Digital Network Number (“MSISDN”), International Mobile Subscriber Identifiers 
(“IMSI’), or International Mobile Equipment Identities (“IMEI”), and any other 
information regarding the types of devices used to access the account; 


All activity logs for the account; 


All location information for the account, including all location data collected by any 
plugins or widgets; 


The types of service utilized by the user; 
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AA. All information about the account’s use of Twitter’s link service, including all website links 
embedded in, exporting data to, or importing data from, the account’s website or blog; 


BB.  AIl full website links that were shortened by Twitter’s link service, all resulting shortened 
links, and all information about the number of times that a link posted by the account was 
clicked; 


CC. All information about connections between the account and third-party websites and 
applications, including any Twitter, Facebook or other social networking accounts to which 
posts from the account are sent; 


DD. All data and information that has been deleted by the user; 


EE. The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 


FF. All privacy settings and other account settings, including email addresses or other accounts 
that the account has blocked; 


GG. Information regarding linked accounts, including accounts linked by cookie, IP address 
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie 


ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device 
identifier, or any other account or device identifier; 


HH. Information regarding accounts linked to accounts to which the Target Accounts are linked; 
ut All records pertaining to communications between the Service Provider and any person 
regarding the user or the user’s account with the Service Provider, including contacts with 
support services, records of actions taken, and investigative or user complaints concerning 
the subscriber. 
I. Information to be Seized by the Government 
Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from March 1, 2016 to the present, including: 
-4- 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, Julian 

Assange, Randy Credico, any 
individual associated with the Trump Campaign, or any witness in the 
investigation; 

Gs Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 


any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

ie Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

f, The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

fis Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

0. All existing printouts from original storage which concern the categories identified 


in subsection II.a. 
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Ill. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02905 
INFORMATION ASSOCIATED WITH ONE Assigned To : Howell 
ACCOUNT STORED AT PREMISES Assign. Date : 9/26); » Beryl A. 
CONTROLLED BY TWITTER Description: S 2018 


on: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant’’) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. §2705(b). In regard to the non- 
disclosure, the proposed Order would direct TWITTER, LLC (“TWITTER”), an electronic 
communication and/or remote computing services provider headquartered in San Francisco, 
California, not to notify any other person (except attorneys for TWITTER for the purpose of 
receiving legal advice) of the existence or content of the Warrant for a period of one year or until 
further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 

A The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

Dos In addition, this Court has jurisdiction to issue the requested order because it is “a 


court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
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“district court of the United States . . . that — has jurisdiction over the offense being investigated.” 
18 U.S.C. § 2711(3)(A)(i). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

s} Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). TWITTER provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how TWITTER may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(1)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 
notification. In relevant part, Section 2705(b) provides as follows: ! 

(b) Preclusion of notice to subject of governmental access. — A governmental 

entity acting under section 2703 . . . may apply to a court for an order commanding 

a provider of electronic communications service or remote computing service to 

whom a warrant, subpoena, or court order is directed, for such period as the court 

deems appropriate, not to notify any other person of the existence of the warrant, 

subpoena, or court order. The court shall enter such an order if it determines that 

there is reason to believe that notification of the existence of the warrant, subpoena, 

or court order will result in— 

(1) endangering the life or physical safety of an individual; 

' Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 


§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(2) flight from prosecution; 
(3) destruction of or tampering with evidence; 
(4) intimidation of potential witnesses; or 
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must he issued once the Government makes the 
requisite showing about potential consequences of notification: 
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 


government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 


In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ201403 1422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command TWITTER not to notify any other person (except attorneys for TWITTER for the 
purpose of receiving legal advice) of the existence of the Subpoena for a period of one year or until 
further order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S.C. 
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a 
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent), 
18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), and 22 U.S.C. § 611 et seq. 


(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject 
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: Offenses”), arising out of the conduct of Roger Stone and others. It does not appear that Stone is 
currently aware of the full nature and scope of the ongoing FBI investigation. Disclosure of this 
warrant to Stone could lead him to destroy evidence or notify others who may delete information 
relevant to the investigation. 

cz In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that TWITTER and its employees be directed not to notify any other person of 
the existence or content of the Warrant (except attorneys for TWITTER for the purpose of 
receiving legal advice) for a period of one year or until further order of the Court. Such an order 
is appropriate because the Warrant relates to an ongoing criminal investigation, the scope and 
nature of which is neither public nor known to the targets of the investigation, and its disclosure 
may alert these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of 
the Warrant and related papers may also alert the targets to the scope of information known to the 
FBI. Once alerted to this information, potential targets would be immediately prompted to destroy 
or conceal incriminating evidence, alter their operational tactics to avoid future detection, and 
otherwise take steps to undermine the investigation and avoid future prosecution. In particular, 
given that they are known to use electronic communication and remote computing services, the 
potential target could quickly and easily destroy or encrypt digital evidence relating to their 
criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 


longer needed, the Government will notify the Court and seek appropriate relief. 


Case 1:19-mc-00029-CRC Document 29-23 Filed 04/28/20 Page 57 of 59 


9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C, 
§ 2705(b)(2)-(S). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with TWITTER, the United States is aware that, absent a 
court order under Section 2705(b) commanding TWITTER not to notify anyone about a legal 
request, TWITTER may, upon receipt of a warrant seeking the contents of electronically stored 
wire or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto ae other related materials be placed under seal, and furthermore, that the Court command 
TWITTER not to notify any other person of the existence or contents of the above-captioned 
warrant (except attorneys for TWITTER for the purpose of receiving legal advice) for a period of 
one year or until further order of the Court. 

Respectfully submitted, 


ROBERT S. MUELLER, III 


Special ae 


Kyle R: 
The`Special Counsel’s Office 
(202) 616-3812 


Dated: 9/20 AZ By: 
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SEP 2 6 2018 
IN THE UNITED STATES DISTRICT COURT Clerk, U.S. Distri 
FOR THE DISTRICT OF COLUMBIA Courts for the District of patie 4 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02905 
INFORMATION ASSOCIATED WITH ONE Assigned To : Howell, Bervi A 
ACCOUNT STORED AT PREMISES Assign. Date : 9/26/201 8 a 


CONTROLLED BY TWITTER Description: Search & Seizure Warrant 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require TWITTER, INC. (“TWITTER”), an electronic communication and/or remote 
computing services provider headquartered in San Francisco, California, not to disclose the 
existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), TWITTER and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 


attorneys for TWITTER for the purpose of receiving legal advice) for a period of one year or until 


further order of the Court. 
THE HONORAB bl A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 
pls 
Dat 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 


District of Columbia 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH ONE ACCOUNT 
STORED AT PREMISES 
CONTROLLED BY GOOGLE 


SEARCH AND SEIZURE WARRANT 


Case: 1:18-sc—02906 

Assigned To : Howell, Beryl A. 

Assign. Date : 9/26/2018 

Description: Search & Seizure Warrant 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before October 9, 2018 (not to exceed 14 days) 
in the daytime 6:00 a.m. to 10:00 p.m. C at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) C until, the facts justifying, the later specific date of 


Date and time issued: VALUE Zf Jp 27 A. PAAA 


Judge's signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Google accounts, which 
are stored at premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a 


company headquartered in Mountain View, California: 
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ATTACHMENT B 


I. Information to be disclosed by Google 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 


information that have been deleted but are still available to Google, or have been preserved 


pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 


information to the government for each account listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

The types of service utilized; 

All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 


we 


Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 5 of 58 


e, All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 


actions taken; 


f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All Google Analytics information associated with the account (including all 


properties and UA codes associated with the account, and, for each of these 


proprieties and UA codes, all usernames and email accounts associated with them); 


j. All Google Developers Console information associated with the account; 
k. All Minutemaid information associated with the account; 

l. All Android information associated with the account; 

m. Ali Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; 


q. All Web & App Activity associated with the account; 


r. All Google Drive information associated with the account; 
s. All Google+ information associated with the account; 
t. All device information associated with the account, including all instrument or 


telephone numbers (including MAC addresses, Flectronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 


Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 


ea 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (“IMEI’)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 

linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

H. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 

abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 

U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 

access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 

conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from March 1, 2016 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, = «i: 


individual associated with the Trump Campaign, any witness in the investigation; 

Ge Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

(a All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 


to the crimes under investigation and to the account owner; 


h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 
i. The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 


in subsection Il.a. 


sib 
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HI. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 


F- 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT SEP beds h a 


a for the Clerk, U.S. District & Bankruptcy 
District of Columbia Courts for the District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 
INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED 
BY GOOGIF 


Case: 1:18-sc—02906 

Assigned To : Howell, Beryl A. 

Assign. Date : 9/26/2018 

Description: Search & Seizure Warrant 


Nm a ed ee Ne ee” 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 
located in the Northern District of i California , there is now concealed (identify the 


person or describe the property to be seized): 
See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
© evidence of a crime; 
© contraband, fruits of crime, or other items illegally possessed; 
property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
52 U.S.C. § 30121 Foreign Contribution Ban 
18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 
The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: = ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 
SS ————— 
. Ne 
Reviewed by AUSA/SAUSA: Applicant's signature 
Kyle R. Freeny (ASC) l Patrick J. Myers, Special Agent, FBI _ 


Printed name and title 


Sworn to before me and signed in my presence. 


pac: ZAC 24F Lt 3 Lite 


Judge's signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and litle 


City and state: Washington, D.C. 
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SEP 2 6 2018 


IN THE UNITED STATES DISTRICT COURT Clerk, U.S. District & Bankruptcy 
FOR THE DISTRICT OF COLUMBIA Vourts for the District of Columbla 
IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02906 
INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A. 
ONE ACCOUNT STORED AT PREMISES Assign. Date : 9/26/2018 


CONTROLLED BY GOOGLE, PLO Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 


i I make this affidavit in support of an application for a search warrant for 


information associated with the Google account 
which is stored at premises owned, maintained, controlled or operated by Google, LLC 


(“Google”), a company headquartered in Mountain View, California. 


Upon receipt of the information described in Attachment A, government-authorized 


persons will review that information to locate the items described in Attachment B. 

2: Iam a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 

3: The facts in this affidavit come from my personal observations, my training and 


experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
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intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

Se This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(1)(A), & 
(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 
PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 
6. Roger STONE is a self-employed political strategist/consultant and has been 


actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 


ae 
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Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii. Jerome CORSI 

T Jerome CORSI is a political commentator who, according to publicly available 
information, currently serves as the “Washington Bureau Chief for Inforwars.com.” According 
to publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 


and maintained that access until at least June 2016.” The USIC attributed these cyber activities 


to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 


Ae 
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in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 


elections in numerous Florida counties. 


5. 
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18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22,2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 


22: On August 8, 2016, STONE addressed the Southwest Broward Republican 


Jĝ: 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton president campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23 On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25; On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 


27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 


EA 
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soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31, On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 


32. | Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything J know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. J hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE?’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 


35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
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Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks.! The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 


accurate and authentic. The New York Times printed the Pentagon Papers which were 


' On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with stone, Others Regarding 
Forthcoming Leaks 


41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE’s BE cress, ©: October 


17, 2017, Chief Judge Howell issued a search warrant for one of STONE’ fl addresses, 


ae. or about December 19, 2017, Chief Judge Howell issued a search 


warrant for ae account. On or about March 14, 2018, Chief Judge Howell 


issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 


42. Onor about May 15, 2016, = O CORSI: “Here is my flight 


schedule. Need to get something confirmed now... .” CORSI responded, “I copied Roger 


Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 


Ali: 
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appears to have forwarded the message to STONE at O G replied to 


CORSI that, “May meet Manafort -guarantee nothing.” 


43. On or about May 18, 2016, CORSI emailed STONE at 


I believe that 


with the title, “Roger -- why don't you look this over before I send it to 


CORSI wrote, 
and I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 


was very cordial. He would look for this memo from you this afternoon.” 


44. On July 25, 2016, STONE, using 0o B an email to 


CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 


45, On or about July 31, 2016, STONE, using 


CORSI with the subject line, “Call me MON.” The body of the email read: | hould see 
Assange[.] | find Bernie [S]anders. brother who called Bill a Rapist — turn him for 
Trump].| | OR find = Q more proof of Bill getting kicked out.” 
46. On or about August 2, 2016 (approximately 19 days before STONE publicly 

tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 

0O .:: is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 


campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 


Sie 
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be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. On or about August 5, ga g associate of STONE’s, emailed 
STONE at Oo email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” o 9 stated to investigators that, around the 
same time, STONE told him he had gone to London to meet assanor J -~ stated 
that in 2013 told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told a. was joking and 
had not actually met ASSANGE.? 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email i. have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this afternoon[.]” The following day, the associate asked, 


“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 


“hae 
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call later — heading for airport now[.]” Additionally, investigators have identified a photograph in 


STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 


information indicating that it was taken in Los Angeles. 


49, On or about August 15, 2016, CORSI emailed STONE at 


‘Give me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. On or about August 31, 2016, CORSI emailed STONE at 
ae |: you get the PODESTA writeup.” STONE replied “[y]es.” 

5I: On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52: On or about September 6, 2016, CORSI emailed STONE at 
= K Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24, 2016 cite CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again codey. I ve back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 


about file[.]” In a subsequent meeting with investigators fin indicated this 


conversation concerned possible derogatory information he was trying to obtain from Turkey. 
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54. On or about October 3, 2016, an associate of STONE emailed STONE at 
© asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 

back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. ld say that’s 
important.” 

55. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE at ae: was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].”, BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his me g a big 


democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channe! to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. 


59, According to a publicly available news article,’ at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

60. According to phone — «| at approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 


approximately twenty minutes. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 1d74714-8ce5-1 1e6-875e-2cl bfe943b66_story.html 


cis 


Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 27 of 58 


64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE vin i _—_—— “I expect 


that much of next dump focus, setting stage for Foundation debacle.” 

66. At approximately 7 G author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 
Players02@gmail.com, forwarded O 3:22 to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 


G. STONE Asks CORSI for “SOMETHING?” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 


numbers.” 


68. Onor about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 


win i emailed Corsi asking him to “send me your best podesta links.” 


STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 


CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 


BoA 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at he g the subject 
line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at 

= os -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “TIl give you one more — NOBODY YET HAS THIS{:] It looks to me 
like | ee maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once fi 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 


Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank{.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72: On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email at O the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did a : controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent Jo with the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 

I ss, Fo 
ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off].]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pls call. Important.” 

TE: On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I shate a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 


“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 


account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 


Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 32 of 58 


Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 33 of 58 


I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. ... 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89, In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 

encouragement heen in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange, 

you were only referring to a single fact that you had confirmed with the intermediary — 

MR. STONE: That — 

Q: -- was the length and the breadth of what you were referring to? 

MR, STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. ... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, ““Stonewall it. Plead the fifth. Anything to 
save the plan’........ Richard Nixon{.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 


the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 


aoe 


Case 1:19-mc-00029-CRC Document 29-24 Filed 04/28/20 Page 35 of 58 


back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would blish them — which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “Jt was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. Onor about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 


“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.]* You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth . .. You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back . . . and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 


perjury if you’re stupid enough to testify[.]” 


4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the 
FBI. 
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98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99, On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs ... + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee . . . But you’ ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 


reporters copies of email messages he had received from STONE in the prior few days that 
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stated, “You are arat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you start bringing up my dog, you’re crossing the line[.]°”° 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.° In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 


He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 


have prostate cancer and did not have any such discussion with STONE. 


> https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 
6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERNING GOOGLE 


112. In my training and experience, I have learned that Google provides a variety of on- 
line services, including electronic mail (“email”) access, to the public. Google allows subscribers 
to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers 
obtain an account by registering with Google. During the registration process, Google asks 
subscribers to provide basic personal information. Therefore, the computers of Google are likely 
to contain stored electronic communications (including retrieved and unretrieved email) for 
Google Mail subscribers and information concerning subscribers and their use of Google Mail 
services, such as account access information, email transaction information, and account 


application information. In my training and experience, such information may constitute evidence 
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of the crimes under investigation because the information can be used to identify the account’s 
user or users. 

113. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 
(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

114. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(i.e., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging into the account via the provider’s website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the IP address used to register the 
account and the IP addresses associated with particular logins to the account. Because every device 
that connects to the Internet must use an IP address, IP address information can help to identify 
which computers or other devices were used to access the email account. 

115. In my training and experience, in some cases, email account users will 


communicate directly with an email service provider about issues relating to the account, such as 
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technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 
evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

116. This application seeks a warrant to search all responsive records and information 
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where 
Google has chosen to store such information. The government intends to require the disclosure 
pursuant to the requested warrant of the contents of wire or electronic communications and any 
records or other information pertaining to the customers or subscribers if such communication, 
record, or other information is within Google’s possession, custody, or control, regardless of 
whether such communication, record, or other information is stored, held, or maintained outside 
the United States. 

117. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
lists, and images sent (and the data associated with the foregoing, such as date and time) may 


indicate who used or controlled the account at a relevant time. Further, information maintained by 
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the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time (e.g., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g., communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 
FILTER REVIEW PROCEDURES 

118. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 
119. Based on the forgoing, I request that the Court issue the proposed search warrant. 
120. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 


required for the service or execution of this warrant. 
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REQUEST FOR SEALING 
121. J further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


a = 
ee a E 
Patrick J. Myers 
Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this LO ie of September, 2018. 


The L Beryl A. Howell 


Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Google accounts, which 
are stored at premises owned, maintained, controlled, or operated by Google, LLC (“Google”), a 


company headquartered in Mountain View, California: 
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ATTACHMENT B 


I. Information to be disclosed by Google 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 


information that have been deleted but are still available to Google, or have been preserved 


pursuant to a request made under 18 U.S.C. § 2703(£), Google is required to disclose the following 


information to the government for each account listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

The types of service utilized; 

All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 
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e. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 


actions taken; 


f. All subscriber “change history” associated with the account; 
g. All search history and web history associated with the account; 
h. All location and maps information associated with the account; 


i. All Google Analytics information associated with the account (including all 
properties and UA codes associated with the account, and, for each of these 


proprieties and UA codes, all usernames and email accounts associated with them); 


j- All Google Developers Console information associated with the account; 
k. All Minutemaid information associated with the account; 

l. All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; 


q All Web & App Activity associated with the account; 


r. All Google Drive information associated with the account; 
s. All Google+ information associated with the account; 
t. All device information associated with the account, including all instrument or 


telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 


Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities (““IMEI’)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 

linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

II. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 

abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 

U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 

access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 

conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from March 1, 2016 to the present, including: 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, Eoo Julian 


individual associated with the Trump Campaign, any witness in the investigation; 

& Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

ê: All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context ofaccount access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

j; Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 


in subsection Il.a. 
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UI. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02906 
INFORMATION ASSOCIATED WITH ONE Assigned To : Howell, Beryl A 
ACCOUNT STORED AT PREMISES Assign. Date : 9/26/2018 
CONTROLLED BY GOOGLE Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 


moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non- 
disclosure, the proposed Order would direct Google, an electronic communication and/or remote 
computing services provider headquartered in Mountain View, California, not to notify any other 
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or 
content of the Warrant for a period of one year or until further order of the Court. 
JURISDICTION AND LEGAL BACKGROUND 

l. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2a In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 


“district court of the United States . . . that — has jurisdiction over the offense being investigated.” 
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18 U.S.C. § 2711(3)(A)G). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

By Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. §2705(b). Google provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Google may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(1)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4, The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 
notification. In relevant part, Section 2705(b) provides as follows:! 

(b) Preclusion of notice to subject of governmental access. — A governmental 

entity acting under section 2703 . . . may apply to a court for an order commanding 

a provider of electronic communications service or remote computing service to 

whom a warrant, subpoena, or court order is directed, for such period as the court 

deems appropriate, not to notify any other person of the existence of the warrant, 

subpoena, or court order. The court shall enter such an order if it determines that 

there is reason to believe that notification of the existence of the warrant, subpoena, 

or court order will result in— 


(1) endangering the life or physical safety of an individual; 
(2) flight from prosecution; 


' Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(3) destruction of or tampering with evidence; 
(4) intimidation of potential witnesses; or 
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 
requisite showing about potential consequences of notification: 
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 


government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 


In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. $ 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

J; Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Google not to notify any other person (except attorneys for Google for the purpose of 
receiving legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. The Federal Bureau of Investigation (“FBT”) is investigating violations of 18 U.S.C. 
§ 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18 U.S.C. § 4 (misprision of a 
felony); 18 U.S.C. § 371 (conspiracy); 18 U.S.C. § 1030 (unauthorized access of a protected 
computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject Offenses”), in 
connection with efforts to compromise the networks of the Democratic National Convention 
(“DNC”), the Democratic Congressional Campaign Committee (“DCCC”), and the email accounts 


of U.S. persons, followed by the public release of stolen materials through various outlets. 
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7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Google and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal 
advice) for a period of one year or until further order of the Court. Such an order is appropriate 
because the Warrant relates to an ongoing criminal investigation, the scope and nature of which is 
neither public nor known to the targets of the investigation, and its disclosure may alert these 
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant and 
related papers may also alert the targets to the scope of information known to the FBI. Once alerted 
to this information, potential targets would be immediately prompted to destroy or conceal 
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic communication and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 

9, There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 


§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
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compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Google, the United States is aware that, absent a court 
order under Section 2705(b) commanding Google not to notify anyone about a legal request, 
Google may, upon receipt of a warrant seeking the contents of electronically stored wire or 
electronic communications for a certain account, notify the subscriber or customer of the existence 
of the warrant prior to producing the materia! sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Google not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year or 
until further order of the Court. 

Respectfully submitted, 


ROBERT S. MUELLER, II 
Special Counsel 


Dated: 79/2 6/18 


. Freeny 
ecial Counsel’s Office 
(202) 616-3812 
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wee: TY 
SEP Z 6 208 
IN THE UNITED STATES DISTRICT COURT Clerk, U.S, Dietriet « 


FOR THE DISTRICT OF COLUMBIA Courts for the District a1 Got, 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-0299 

INFORMATION ASSOCIATED WITH ONE Assigned To: oni IA 
pe 7 ġ ! e . 

ACCOUNT STORED AT PREMISES Assign. Date : 9/26/2018 2 


CONTROLLED BY GOOGLE nares 
ae Description: Search & Seizure Warrant 


ORDER 


The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Google, an electronic communication and/or remote computing services provider 
headquartered in Mountain View, California, not to disclose the existence or contents of the 
Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 


materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Google for the purpose of receiving legal advice) for a period of one year or until 


further order of the Court. 


THE antics E BERYL A. HOWELL, 


CHIEF UNITED STATES DISTRICT JUDGE 


_ DLA bL RNG 


Date 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 


In the Matter of the Search of ) eer ae | 
(Briefly describe the property to be searched ) rene 1 d 8 ee 02918 | 
or identify the person by name and address) ) ssigne To : Howell, Beryl A. 
INFORMATION ASSOCIATED WITH TWO ACCOUNTS ) Assign. Date : 9/27/2018 
STORED AT PREMISES ) Description: Search & Seizure Warrant 
CONTROLLED BY TWITTER ) z 
SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California 


(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before October 11, 2018 (not to exceed 14 days) 


Mf in the daytime 6:00 a.m. to 10:00 p.m. Oat any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) f 

O for days (not to exceed 30) 1 until, the facts justifying, the later specific datẹ' of 


Date and time issued: We A La /, i of Yio PA 7 se ee: 


dudge’s signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) f 


Return 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the Twitter accounts registered to the 
following email addresses, which are stored at premises owned, maintained, controlled, or 


operated by Twitter, Inc. (“Twitter”), a company headquartered in San Francisco, California 


I. 
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ATTACHMENT B 
Information to be disclosed by Twitter 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Twitter, Inc. (“Twitter”), including any messages, records, files, logs, or 


information that have been deleted but are still available to Twitter, or have been preserved. 


pursuant to a request made under 18 U.S.C. § 2703(£), Twitter is required to disclose the following 


information to the government for each account listed in Attachment A: 


A. 


H. 


All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the account, 
and all photographs or images included in those Tweets and Direct Messages; 


The content of all communications (public or private) sent to or from, stored in draft form 
in, or otherwise associated with the account, including the content of all messages, 
attachments, and header information; 


All data and information associated with the profile page, including photographs, “bios,” 
and profile backgrounds and themes; 


All other content associated with the account, including, but not limited to, posts, 
documents, spreadsheets, photos, and videos; 


All information from the "Connect" tab for the account, including all lists of Twitter users 
who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets 
that include the username associated with the account (i.e., “mentions” or “replies”), 


All photographs and images in the user gallery for the account; 


All location data associated with the account, including all information collected by the 
“Tweet With Location” service; 


All information about the account's use of Twitter’s link service, including all longer 
website links that were shortened by the service, all resulting shortened links, and all 
information about the number of times that a link posted by the account was clicked; 


All data and information that has been deleted by the user; 


A list of all of the people that the user follows on Twitter and all people who are following 
the user (i.e., the user’s “following” list and “followers” list); 


A list of all users that the account has “unfollowed” or blocked; 
All “lists” created by the account; 


os 
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All information on the “Who to Follow” list for the account; 
All privacy and account settings; 


All records of Twitter searches performed by the account, including all past searches saved 
by the account; 


All current and historical subscriber and payment information, including full name, e-mail 
address (including any secondary or recovery email addresses), physical address (including 
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number, 
websites, screen names, user identification numbers, security questions. and answers, 
registration IP address, payment history, and other personal identifiers; 


All email addresses and telephone numbers ever registered (whether successfully or not) 
to the account, including dates of any changes and the IP addresses used for any changes; 


All past and current usernames, account passwords, and names associated with the account, 
including dates of any changes and the IP addresses used for any changes; 


All data and information associated with the profile page, including photographs; 


All advertising data relating to the account, including, but not limited to, information 
regarding unique advertising IDs associated with the user, any devices used to access the 
account, application IDs, UDIDs, payment information (including, but not limited to, full 
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads 
created; 


The dates and times at which the account and profile were created, and the Internet Protocol 
(“IP”) address at the time of sign-up; 


All transactional records associated with the account, including any IP logs or other records 
of session times and durations; 


Any information identifying the device or devices used to access the account, including a 
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers, 
MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers 
(“MEIN”), Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services 
Digital Network Number (“MSISDN”), International Mobile Subscriber Identifiers 
(“IMSY”), or International Mobile Equipment Identities (“IMEI”), and any other 
information regarding the types of devices used to access the account; 


All activity logs for the account; 


All location information for the account, including all location data collected by any 
plugins or widgets; 


The types of service utilized by the user; 


a 


BB. 


CC. 


DD. 


EE. 


FF. 


GG. 


HH. 


I. 


Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 6 of 61 


Allinformation about the account’s use of Twitter’s link service, including all website links 
embedded in, exporting data to, or importing data from, the account’s website or blog; 


All full website links that were shortened by Twitter’s link service, all resulting shortened 
links, and all information about the number of times that a link posted by the account was 
clicked; 


All information about connections between the account and third-party websites and 
applications, including any Twitter, Facebook or other social networking accounts to which 
posts from the account are sent; 


All data and information that has been deleted by the user; 


The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 


All privacy settings and other account settings, including email addresses or other accounts 
that the account has blocked; 


Information regarding linked accounts, including accounts linked by cookie, IP address 
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie 
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device 
identifier, or any other account or device identifier; 


Information regarding accounts linked to accounts to which the Target Accounts are linked; 


All records pertaining to communications between the Service Provider and any person 
regarding the user or the user’s account with the Service Provider, including contacts with 
support services, records of actions taken, and investigative or user complaints concerning 
the subscriber. 


Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from March 1, 2016 to the present, including: 


-4- 
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All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked eaten communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, T- 


individual associated with the Trump Campaign, any witness in the investigation; 
Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 


5. 
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Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

All existing printouts from original storage which concern the categories identified 


in subsection I.a. . 
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HI. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 


-7- 
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FILED 
SEP 27 2018 


Clerk, U.S. District & Bankrupte 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1:18~sc—02918 

INFORMATION ASSOCIATED WITH TWO ! Assigned To : Howell, Beryl A. 
ACCOUNTS STORED AT PREMISES Assign. Date : 9/27/2018 
CONTROLLED BY TWITTER Description: Search & Seizure Warrant 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require TWITTER, INC. (“TWITTER”), an electronic communication and/or remote 
computing services provider headquartered in San Francisco, California, not to disclose the 
existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). | 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), TWITTER and its 


attorneys for TWITTER for the purpose of receiving legal advice) for a period of one year or until 


| 
employees shall not disclose the existence or content of the Warrant to any other person (except | 
further order of the Court. | 


THE a BERYL A. HOWELL 


CHIEF UNITED STATES DISTRICT JUDGE 


I/ztja ti 


Date 


H 
i 
f 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT 


are SEP 27 2018 
District of Columbia Clerk, U.S, District & Bankruptcy 
Courts for the District of Columbia 
In the Matter of the Search of ) c 
Briefly describe th tob hed ase: 1:18-sc- 
AAE para Dh nce and cad eE Assigned 7, Sc-02918 
INFORMATION ASSOCIATED WITH Age) 0: Howell, Beryl A 
TWO ACCOUNTS STORED AT PREMISES 1 D gn. Date : 9727/2018 ° 
CONTROLLED BY TWITTER ) escription: Search & Seizure W 
arrant 


APPLICATION FOR A SEARCH WARRANT 


J, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 
located in the _ Northern ——__—s«CDistrrict of California , there is now concealed (identify the 


person or describe the property to be seized): 
See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
evidence of a crime; 
W contraband, fruits of crime, or other items illegally possessed; 
wo property designed for use, intended for use, or used in committing a crime; 


C a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
52 U.S.C. § 30121 Foreign Contribution Ban . 
18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 


The application is based on these facts: 
See attached Affidavit. 


@ Continued on the attached sheet. 


O Delayed notice of __ days (give exact ending date if more than 30 days: } is Fequested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: : - Applicant's signature 


Kyle R. Freeny (ASC) 7 Patrick J. Myers, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence, 


vac: _ MAHD EGGP pe 


l Judge's signature 


City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and tille 


Case 1:19-mc-00029-CRC Document 29-25 Filed 04/28/20 Page 13 of 61 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc~02918 

INFORMATION ASSOCIATED WITH TWO > Assigned To : Howell, Beryl A 
ACCOUNTS STORED AT PREMISES Assign, Date : 9/27/2018 
CONTROLLED BY TWITTER Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 


moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non- 
disclosure, the proposed Order would direct TWITTER, LLC (“TWITTER”), an electronic 
communication and/or remote computing services provider headquartered in San Francisco, 


California, not to notify any other person (except attorneys for TWITTER for the purpose of 


receiving legal advice) of the existence or content of the Warrant for a period of one year or until 


further order of the Court. 


JURISDICTION AND LEGAL BACKGROUND 

L. The Court bas the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon y. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

Z: In addition, this Court has jurisdiction to issue the requested order because it is “a 


court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
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“district court of the United States . . . that — has jurisdiction over the offense being investigated.” 
18 U.S.C. § 2711@)(A)(i). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3, Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). TWITTER provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2), The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how TWITTER may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant, Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(1)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4, The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 
notification. In relevant part, Section 2705(b) provides as follows:! 

(b) Preclusion of notice to subject of governmental access. — A governmental 

entity acting under section 2703 . .. may apply to a court for an order commanding 

a provider of electronic communications service or remote computing service to 

whom a warrant, subpoena, or court order is directed, for such period as the court 

deems appropriate, not to notify any other person of the existence of the warrant, 

subpoena, or court order, The court shall enter such an order if it determines that 

there is reason to believe that notification of the existence of the warrant, subpoena, 

or court order will result in— 

(1) endangering the life or physical safety of an individual; 

! Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C, 


§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(2) flight from prosecution; 
(3) destruction of or tampering with evidence; 
(4) intimidation of potential witnesses; or 
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 
requisite showing about potential consequences of notification: 
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 
In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 
5; Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command TWITTER not to notify any other person (except attorneys for TWITTER for the 
purpose of receiving legal advice) of the existence of the Subpoena for a period of one year or until 


further order of the Court. 


FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S.C. 
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision ofa 
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent), 
18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer); 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), and 22 U.S.C. § 611 ef seq. 


(Foreign Agents Registration Act), and $2 U.S.C. § 30121 (foreign contribution ban) (the “Subject 
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Offenses”), arising out of the conduct of Roger Stone and others. It does not appear that Stone is 
currently aware of the full nature and scope of the ongoing FBI investigation. Disclosure of this 
warrant to Stone could lead him to destroy evidence or notify others who may delete ‘nfonination 
relevant to the investigation. 

7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that TWITTER and its employees be directed not to notify any other person of 
the existence or content of the Warrant (except attorneys for TWITTER for the purpose of 
receiving legal advice) for a period of one year or until further order of the Court. Such an order 
is appropriate because the Warrant relates to an ongoing criminal investigation, the scope and 
nature of which is neither public nor known to the targets of the investigation, and its disclosure 
may alert these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of 
the Warrant and related Rapes may also alert the targets to the scope of information known to the 
FBI. Once alerted to this information, potential targets would be immediately prompted to destroy 
or conceal incriminating evidence, alter their operational tactics to avoid future detection, and 
otherwise take steps to undermine the investigation and avoid future prosecution, In particular, 
given that they are known to use electronic communication and remote computing services, the 
potential target on quickly and easily destroy or encrypt digital evidence relating to their 
criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 


circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 


longer needed, the Government will notify the Court and seek appropriate relief. 
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9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with cvidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with TWITTER, the United States is aware that, absent a 
court order under Section 2705(b) commanding TWITTER not to notify anyone about a legal 
request, TWITTER may, upon receipt of a warrant seeking the contents of electronically stored 
wire or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to ee the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
TWITTER not to notify any other person of the existence or contents of the above-captioned 
warrant (except attorneys for TWITTER for the purpose of receiving legal advice) for a period of 
one year or until further order of the Court. 

Respectfully submitted, 


ROBERT S. MUELLER, II 
Special Counsel 


Dated: 72/Z-F# 1B By: 


(202) 616-3812 
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FILED 


IN THE UNITED STATES DISTRICT COURT SEP 27 2018 


FOR THE DISTRICT OF COLUMBIA Clerk, U.S. District & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02918 
INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryl A. 

TWO ACCOUNTS STORED AT PREMISES | assign. Date : 9/27/2018 - 
CONTROLLED BY TWITTER Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 
i. I make this affidavit in support of an application for a search warrant for 
information associated with the two Twitter accounts (the “Target Accounts”), stored at premises 


owned, maintained, controlled or operated by Twitter, Inc, (“Twitter”), a company headquartered 


in San Francisco, California. As set forth below, the Target Accounts 


Upon receipt 


of the information described in Attachment A, govemment-authorized persons will review that 
information to locate the items described in Attachment B. 

2. Į am a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, J have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 

3, The facts in this affidavit come from my personal observations, my training and 


experience, and information obtained from other FBI personnel and witnesses. This affidavit is 


mienas aaan ian: 
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intended to show merely that there is sufficient probable cause for the anaa warrant and 
does not set forth all of my knowledge about this matter. 

4, Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause lo believe that the Target Accounts contains soins fruits, or 
instrurmentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 USC. § 4 (misprision of a felony), 18 
U.S.C. § 100! (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is E 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 


JURISDICTION 


5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (ÞX1XA), & 
(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 


judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 


§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 


“ PROBABLE CAUSE 


A. Background on Relevant Individuals 
i. Roger STONE 
6. Roger STONE is a self-employed political strategist/consultant and has been 


actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 


zJ: 
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Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with iadividuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, served as the “Washington Bureau Chief for Inforwars.com.” According to 
publicly-available sources, from-2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND,com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 


igs 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9 On January 6, 2017, the USIC released a declassified version of an intelligence 


assessment of Russian activities and intentions during the 2016 presidential election entitled, 


“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 


assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian 
‘Government developed a clear preference for President-elect Trump. 

10. - In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.”” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n J uly 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 


- and maintained that access until at least June 2016.” The USIC attributed these cyber activities 


to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
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in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets,” 

13. Gucecifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals ed with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully ned 
` access to DNC computers housed on a third-party éicvid-cotipiiting service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. Onor about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 


elections in numerous Florida counties. 
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18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 20] 6 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v, Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19, On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Becitbart cont entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated; “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 


22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@Roger] StoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStonesr dailies 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. . 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “im pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine, 


27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 


29: 
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soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes,” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29, On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration ~ STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 


32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 


to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 


33.  WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to B 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 

| [STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 

with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Chery] Mills, the Clinton aides, 
thought were deleted, I hear that through my emissary.” 

34, On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 


communication during the Campaign between STONE and WikiLeaks, The same article quoted 


STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 


charges | knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So J am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 


35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
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Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks.' The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since 1 was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 


to rexamine the strategy of attacking me- cordially R.” 


36. Less than an hour later, @wikileaks responded by direct message: “We appreciate — 


that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. Onor about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a ites message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 


accurate and authentic. The New York Times printed the Pentagon Papers which were 


i On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStonelr. 
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indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. Ifthe US government 
moves on you I will bring down the entire house of cards. With the imped- sexual assault 
charges dropped I don’t know of any crime you need to be E for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
Do] side that’s coming most strongly from those obsessed with Gade down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 


this forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with sronk, D Others Regarding 
Forthcoming Leaks 


41, On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE’s m On October 17, 


2017, Chief Judge Howell issued a search warrant for one of STONE’s BE caresses, 


On or about December 19, 2017, Chief Judge Howell issued a search 


warrant for email account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. Onor about May 15, 2016 fT cited CORSI: “Here is my flight 


schedule. Need to get something confirmed now. ...” CORSI responded, “I copied Roger 


Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 


STs 
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appears to have forwarded the message to STONE ay who replied to 


CORSI that, “May meet Manafort -guarantee nothing.” 


43. On or about May 18, 2016, CORSI emailed STONE fa 


with the title, “Roger -- why don't you look this over before | send it i: believe that 


Ce 
ae and I did manage to see Mr. Trump for a few minutes today as we were 


waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 


was very cordial. He would look for this memo from you this afternoon.” 

44, On July 25, 2016, STONE, using SI sont an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
fa]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 

45. On or about July 31, 2016, STONE, using 0 R 
CORSI with the subject line, “Call me MON.” The body of the email read: BR oud see 
Assange[.] BB ou find Bernie [S]anders brother who called Bill a Rapist — turn him for 
Trump|.] O find O g more proof of Bill getting kicked out.” 

46. On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barret’), CORSI emailed STONE at 

O0 A is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on HENE more se Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 


campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 


J2 
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be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about, Would not hurt to start suggesting HRC old, memory bad, has stroke -- 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. On or about August 5, 2016, R associate of STONE’s, emailed 
STONE i The email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” P| subsequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet ASSANGE. so stated 
that in 201 i... STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE Zo | he was joking and 
had not actually met ASSANGE.’ 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to o g have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at PEET 3:38PM on August 2, asking “How did ur meeting 


go in LA?” STONE responded. “It’s this afternoon{.]” The following day, the associate asked, 


“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
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call later — heading for airport now{.]” Additionally, investigators have identified a PA in 
STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles, 

.  Onor about August 15, 2016, CORSI emailed STONE at 
ee me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 

until after Labor Day. Pm in NYC this week. Jerry.” 
50. On or about August 31, 2016, CORSI emailed STONE at 
ae you get the PODESTA writeup.” STONE replied “[yJes.” 

On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[blerbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 


52.  Onor about September 6, 2016, CORSI emailed STONE at 


O= K Is NY Post going to use the Pedesta [sic] stuff?” 
53. On or about September 24, 2016 RE st CORSI, “I will have much 


more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 


secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 


it again = RE +e back, “Awaiting secret file. Explosive... Hope you are well. 


Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 


about file[.]” In a subsequent mecting with erta indicated this 


conversation concerned possible derogatory information he was trying to obtain from Turkey. 
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54. On or about October 3, 2016, an associate of STONE emailed STONE at 
nn and asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 

back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. Pd say that’s 
important.” 

55,  Onor about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 


not make any new releases. Instead, ASSANGE promised more documents, including 


information “affecting three powerful organizations in three different states, as well as, of course, 


information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE iii “What was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 


cut deal w/ clintons???” STONE replied, “Don't think so BUT his So g a big 


democrat,” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks, Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had keard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


F. STONE and CORSE Communications on October 7, 2016, when the Podesta Emails 
Are Released. 


59. According to a publicly available news article,? at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously daa video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 


if 


calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

60. According to phone records at at approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61, At approximately 11:53AM, STONE received a phone call from the Washington 


Post. The call lasted approximately twenty minutes. 


62. At approximately 1:42PM, STONE called CORSI and the two spoke for 


approximately seventeen minutes. 


63. At approximately 2:18PM, CORSI called STONE and the two spoke for 


approximately twenty minutes. 


https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 1d74714-8ce5- I 1e6-875e-2c | bfe943b66_story-html 
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64, At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65.  Atapproximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE using | “I expect 


that much of next dump focus, setting stage for Foundation debacle.” 

66. At approximately or g author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 
E om D to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 


G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


67. Onor about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T,” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” 


68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 


using = BR Corsi asking him to “send me your best podesta links.” 


STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 


CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend, Your choice?” 

69. On a about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at both ee the subject 
line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
‘CORSI back via TO ccount, “Got them and used them.” 

TA On or about Thursday, October 13, 2016, CORSI emailed STONE at 
= DONG -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “PH give you one more — NOBODY YET HAS THIS{:] It looks to me 
like | ER maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation{.] [web link] Once i) = 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 


Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72,  Onor about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email aiff vith the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name,” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received Tiin or data from Wikileaks.” The post 
then asked, “Just how much money did i os) a controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by ee: the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC, Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there, Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JEK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 
ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.| I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand offf.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has, If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” Based on review of the original email that CORSI forwarded, the 
“trusted source” was a self-identified retired librarian who gathers information from public chat 
rooms. 

76, On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pls call. Important.” 

77. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. J didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 


“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 


account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks ; i 


88. On September 26, 2017, STONE testified before the House Permanent Select 


Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 


public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that Į had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. .. . 


[LJet me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
Į learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September, This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. Ina document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: _ 

Q: Have any of your employees, associates, or individuals acting on your behest or 

encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in l 

communication with Assange or communication through an intermediary with Assange, 

you were only referring to a single fact that you had confirmed with the intermediary — 

MR, STONE: That - 

Q: -- was the length and the breadth of what you were referring 10? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. 

90. In the month that followed his testimony before HPSCT, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. ... [Mly tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to AS SANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “Stonewall it. Plead the fifth. Anything to 
save the plan’........ Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 


the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — why are u busting my chops?” 

93, On or about November 24, 2017, STONE, texted CREDICO, “Assange isa 
journalist and a damn good one- meeting with him is ii legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them ~ which he himself said in public b4 u told 
me. It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stufff.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax,” 

95.  Onor about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 


“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.]* You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth . . . You want me to cover you for perjury 
now[.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for Sth 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.} But I’m sure 
that wasn’t sworn testimony so you’re probably clear{.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
_,. you should go back . . . and amend your testimony and teli them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. T, tromp [sic] 1 could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 


perjury if you’re stupid enough to testify[.]” 


4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the 
FBI. 
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98. STONE and CREDICO continued to hiai each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence,” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99, On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter, 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs ..; + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee... But you'll get 
off because you're friends with Trump so don’t worry. I have all the forensic evidence[.}] I was 
not a balck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 


reporters copies of email messages he had received from STONE in the prior few days that 
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ae “You are arat. You are a stoolie, You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
,. When you start bringing up my dog, you’re crossing the linef.]”* 

104, On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.° In these messages, STONE, on April 9, 201 8, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 
He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 


have prostate cancer and did not have any such discussion with STONE. 


K. The Target Accounts 


: https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 
é https://www.motherjones.com/politics/20 18/0 Sfroger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERNING TWITTER 


Fel Ei hn tO ier sce 


115, In my training and experience, Twitter owns and operates a free-access social- 


networking website of the same name that can be accessed at http://www.twitter.com. Twitter 
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allows its users to create their own profile pages, which can include a short biography, a photo of 
themselves, and location information. Twitter also permits users create and read 140-character 
messages called “Tweets,” and to restrict their “Tweets” to individuals whom they approve. These 
features are described in more detail below. 

116. Upon creating a Twitter account, a Twitter user must create a unique Twitter 
username and an account password, and the user may also select a different name of 20 
characters or fewer to identify his or her Twitter account, The Twitter user may also change this 
username, password, and name without having to open a new Twitter account. 

117. Twitter asks users to provide basic identity and contact information, either during 
the registration process or deae This information may include the user’s full name, e-mail 
addresses, physical address (including city, state, and zip code), date of birth, gender, hometown, 
occupation, and other personal identifiers. For each user, Twitter may retain information about 
the date and time at which the user’s profile was created, the date and time at which the account 
was created, and the Internet Protocol (“IP”) address at the time of sign-up. Because every 
device that connects to the Internet must use an IP address, IP address information can help to 
identify which computers or other devices were used to access a given Twitter account. 

118. A Twitter user can post a personal photograph or image (also known as an 
“avatar”) to his or her profile, and can also change the profile background or theme for his or her 
account page. In addition, Twitter users can post “bios” of 160 characters or fewer to their profile 
pages. 

119, Twitter also keeps IP logs for each user. These logs contain information about the 
user’s logins to Twitter including, for each access, the IP address assigned to the user and the 


date stamp at the time the user accessed his or her profile. 
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120. As discussed above, Twitter users can use their Twitter accounts to post “Tweets” 
of 140 characters or fewer. Each Tweet includes a timestamp that displays when the Tweet was 
posted to Twitter. Twitter users can also “favorite,” “retweet,” or reply to the Tweets of other 


users. In addition, when a Tweet includes a Twitter username, often preceded by the @ sign, 


Twitter designates that Tweet a “mention” of the identified user. In the “Connect” tab for each 


account, Twitter provides the user with a list of other users who have “favorited” or “retweeted” 
the user’s own Tweets, as well as a list of all Tweets that include the user’s setae (ie, a list | 
of all “mentions” and “replies” for that username). 

121. Twitter users can include photographs or images in their Tweets, Each Twitter 


account also is provided a user gallery that includes images that the user has shared on Twitter, 


including images uploaded by other services. 

122. Twitter users can also opt to include location data in their Tweets, which will 
reveal the users” locations at the time they post each Tweet. This “Tweet With Location” 
function is off by default, so Twitter users must opt in to the service. In addition, Twitter users 
may delete their past location data. 

123, When Twitter users want to post a Tweet that includes a link to a website, they 
can use Twitter’s link service, which converts the longer website link into a shortened link that 
begins with http://t.co. This link service measures how many times a link has been clicked. 

124, A Twitter user can “follow” other Twitter users, which means subscribing to 
those users’ Tweets and site updates. Each user profile page includes a list of the people who are 
following that user (i.e., the user’s “followers” list) and a list of people whom that user follows 
(i.e., the user’s “following” list). Twitters users can “unfollow” users whom they previously 


followed, and they can also adjust the privacy settings for their profile so that their Tweets are 


KES 
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visible only to the people whom they approve, rather than to the public (which is the default 
setting). A Twitter user can also group other Twitter users into “lists” that display on the right _ 
side of the user’s home page on Twitter. Twitter also provides users with a list of “Who to 
Follow,” which includes a few recommendations of Twitter accounts that the user may find 
interesting, based on the types of accounts that the user is already following and who those 
people follow. 

125. In addition to posting Tweets, a Twitter user can also send Direct Messages 
(DMs) to one of his or her followers. These messages are typically visible only to the sender and 
the recipient, and both the sender and the recipient have the power to delete the message from the 
inboxes of both users. As of January 2012, Twitter displayed only the last 100 DMs for a 
particular ‘user, but older DMs are stored on Twitter’s database. 

126. Twitter users can configure the settings for their Twitter accounts in numerous 
ways. For example, a Twitter user can configure his or her Twitter account to send updates to the 
user’s mobile phone, and the user can also set up a “sleep time” during which Twitter updates 
will not be sent to the user’s phone. 

127. Twitter includes a search function that enables its users to search all public 
Tweets for keywords, uscrnames, or subject, among other things. A Twitter user may save up to 
25 past searches. 

128. Twitter users can connect their Twitter accounts to third-party websites and 
applications, which may grant these websites and applications access to the users’ public Twitter 
profiles. 


129. Ifa Twitter user does not want to interact with another user on Twitter, the first 


user can “block” the second user from following his or her account. 
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130. In some cases, Twitter users may communicate directly with Twitter about issues 
relating to their account, such as technical problems or complaints. Social-networking providers 
like Twitter typically retain records about such communications, including records of contacts 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. Twitter may also suspend a particular user 
for breaching Twitter’s terms of service, during which time the Twitter user will be prevented 
from using Twitter’s services, 

131. As explained herein, Aomeni in connection with a Twitter account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, a 
Twitter user’s account information, IP log, stored electronic communications, and other data 
retained by Twitter, can indicate who has used or controlled the Twitter account. This “user 
attribution” evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at a residence, For example, profile contact information, communications, 
“tweets” (status updates) and “tweeted” photos (and the data associated with the foregoing, such 
as date and time) may be evidence of who used or controlled the Twitter account at a relevant 
time. Further, Twitter A activity can show how and when the account was accessed or 
used. For example, as described herein, Twitter logs the Internet Protocol (IP) addresses from — 
which users access their accounts along with the time and date. By determining the physical 
location associated with the logged IP addresses, investigators can understand the chronological 
and geographic context of the account access and use relating to the crime under investigation. 


Such information allows investigators to understand the geographic and chronological context of 
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Twitter access, use, and events relating to the crime under investigation. Additionally, Twitter 
builds geo-location into some of its services, If enabled by the user, physical location is 
automatically added to “tweeted” communications. This geographic and timeline information 
may tend to cither inculpate or exculpate the Twitter account owner. Last, Twitter account 
activity may provide relevant insight into the Twitter account owner’s state of mind as it relates 
to the offense under investigation. For example, information on the Twitter account may 
indicate the owner’s motive and intent to commit a crime (e.g., information indicating a criminal 
plan) or consciousness of guilt (e.g., deleting account information in an effort to conceal 
evidence from law enforcement). 

132. Therefore, the computers of Twitter are likely to contain all the material described 
above, including stored electronic communications and information concerning subscribers and 
their use of Twitter, such as account access information, transaction information, and other 


account information 


FILTER REVIEW PROCEDURES 
133. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements conceming the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 


CONCLUSION 


134. Based on the forgoing, I request that the Court issue the proposed search warrant. 
135, Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 


required for the service or execution of this warrant. 
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REQUEST FOR SEALING 


136, I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further anes of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Patrick J. Myers 
Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this day of September, 2018. 
z ; 
[Ega ha 


The Honorable Bery! A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the Twitter accounts registered to the 
following email addresses, which are stored at premises owned, maintained, controlled, or 


operated by Twitter, Inc. (“Twitter”), a company headquartered in San Francisco, California 


aJ- 
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ATTACHMENT B 


{nformation to be disclosed by Twitter 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Twitter, Inc. (“Twitter”), including any messages, records, files, logs, or 


information that have been deleted but are still available to Twitter, or have been preserved 


pursuant to a request made under 18 U.S.C. § 2703(f), Twitter is required to disclose the following 


information to the government for each account listed in Attachment A: 


A. 


All “Tweets” and Direct Messages sent, received, “favorited,” or retweeted by the account, 
and all photographs or images included in those Tweets and Direct Messages; 


The content of all communications (public or private) sent to or from, stored in draft form 


‘in, or otherwise associated with the account, including the content of all messages, 


attachments, and header information; 


All data and information associated with the profile page, including photographs, “bios,” 
and profile backgrounds and themes; — 


Ali other content associated with the account, including, but not limited to, posts, 
documents, spreadsheets, photos, and videos; 


All information from the "Connect" tab for the account, including all lists of Twitter users 


who have favorited or retweeted Tweets posted by the account, as well as a list of all Tweets 


that include the username associated with the account (i.e., “mentions” or “replies”; 
All photographs and images in the user gallery for the account; 


All location data associated with the account, including all information collected by the 
“Tweet With Location” service; 


All information about the account's use of Twitter’s link service, including all longer 
website links that were shortened by the service, all resulting shortened links, and all 
information about the number of times that a link posted by the account was clicked; 


_ All data and information that has been deleted by the user; 


A list of all of the people that the user follows on Twitter and all people who are following 
the user (i.e., the user’s “following” list and “followers” list); 


A list of all users that the account has “unfollowed” or blocked; 


All “lists” created by the account; - 
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All information on the “Who to Follow” list for the account; 
Ali privacy and account settings; 


All records of Twitter searches performed by the account, including all past searches saved 
by the account; 


All current and historical subscriber and payment information, including full name, e-mail 
address (including any secondary or recovery email addresses), physical address (including 
city, state, and zip code), date of birth, gender, hometown, occupation, telephone number, 
websites, screen names, user identification numbers, security questions. and answers, 
registration IP address, payment history, and other personal identifiers; 


All email addresses and telephone numbers ever registered (whether successfully or not) 
to the account, including dates of any changes and the IP addresses used for any changes; 


All past and current usernames, account passwords, and names associated with the account, 
including dates of any changes and the IP addresses used for any changes; 


All data and information associated with the profile page, including photographs; 


All advertising data relating to the account, including, but not limited to, information 
regarding unique advertising IDs associated with the user, any devices used to access the 
account, application IDs, UDIDs, payment information (including, but not limited to, full 
credit card numbers and expiration dates and PayPal accounts), ads clicked, and ads 
created; 


The dates and times at which the account and profile were created, and the Internet Protocol 
(“IP”) address at the time of sign-up; 


All transactional records associated with the account, including any IP logs or other records 
of session times and durations; — l 


Any information identifying the device or devices used to access the account, including a 
device serial number, a GUID or Global Unique Identifier, a phone number, serial numbers, 
MAC addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity Numbers 
(“MEIN”), Mobile Equipment Identifiers (“MEID”), Mobile Identification Numbers 
(“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber Integrated Services 


. Digital Network Number (“MSISDN”), International Mobile Subscriber Identifiers 
. (“IMSI”), or International Mobile Equipment Identities (“IMEI”), and any other 


information regarding the types of devices used to access the account, 
All activity logs for the account; 


All location information for the account, including all location data collected by any 
plugins or widgets; 


The types of service utilized by the user; 


230 
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BB. . 


CC. 


DD. 


EE. 


FF. 


GG. 


HH. 


I. 


H. 


All information about the account’s use of Twitter’s link service, including all website links 
embedded in, exporting data to, or importing data from, the account’s website or blog; 


All full website links that were shortened by Twitter’s link service, all resulting shortened 
links, and all information about the number of times that a link posted by the account was 
clicked; 


All information about connections between the account and third-party websites and 
applications, including any Twitter, Facebook or other social networking accounts to which 
posts from the account are sent; 


All data and information that has been deleted by the user; 


The length of service (including start date) and the means and source of any payments 
associated with the service (including any credit card or bank account number); 


All privacy settings and other account settings, including email addresses or other accounts 
that the account has blocked; 


Information regarding linked accounts, including accounts linked by cookie, IP address 
(including registration IP address), advertising ID, User Client UUID, User Guest Cookie 
ID, Known Device Token, Normalized Email Address, Android ID, IMEI, GUID, device 
identifier, or any other account or device identifier, l 


Information regarding accounts linked to accounts to which the Target Accounts are linked; 


All records pertaining to communications between the Service Provider and any person 
regarding the user or the user’s account with the Service Provider, including contacts with 
support services, records of actions taken, and investigative or user complaints concerning 
the subscriber. 


"Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from March 1, 2016 to the present, including: 


A. 
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AH records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, | Julian 


individual associated with the Trump Campaign, any witness in the investigation; 
Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; | 

All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benei of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 
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Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)}—-who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

The identity of any person(s)—including records that help reveal the whereabouts 
of the een ae communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. | 

Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

All existing printouts from original storage which concern the categories identified 


in subsection Il.a. 
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i 
HI. Review Protocols | 
Review of the items described in Attachment A and Attachment B shall be conducted | 

ý | 
pursuant to established procedures designed to collect evidence in a manner consistent with | 
, i 

professional responsibility requirements concerning the maintenance of attorney-client and other | 
| 


operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 


Te 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 

In the Matter of the Search of ) Case: 1: 
(Briefly describe the property to be searched ) A ie 18-sc-0291 9 | 
or identify the person by name and address) ) oe To: Howel l Be ryl A. | 
ssign. Date : 9/27/20 | 
INFORMATION ASSOCIATED WITH FOUR ) Description: S - | 
ACCOUNTS STORED AT PREMISES ) Sate & Seizure Warrant 
CONTROLLED BY FACEBOOK ) | 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 
An application by a federal law enforcement officer or an attorney for the government requests the search 


of the following person or property located in the Northern District of California 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before October 11, 2018 (not to exceed 14 days) 
M in the daytime 6:00 a.m. to 10:00 p.m. at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 


property was taken. 
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C, § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay, notice to the per. son. who, or whose 


property, will be searched or seized (check the appropriate box) Ear 
O for days (not to exceed 30) O until, the facts justifying, the later specifig date of 


Date and time issued: 9 2- 77 2R a) Fi Ffl LAA ie 


Judge's signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief.U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Return 


Case No.: Date and time warrant executed: Copy of warrant and inventory left with: 
| 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 


designated judge. 


Executing officer’s signature 
g 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the Facebook accounts registered to 
the following email addresses (“Target Facebook Accounts”), stored at premises owned, 
maintained, controlled, or operated by Facebook, Inc. (“Facebook”), a company headquartered in 


Menlo Park, California: 


This warrant also applies to information associated with the Instagram accounts registered 
to the following email addresses (“Target Instagram Accounts”), stored at premises owned, 


maintained, controlled, or operated by Facebook: 


JE 
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ATTACHMENT B 


L Information to be disclosed by Facebook/Instagram 


A. 


To the extent that the information described in Attachment A is within the 


possession, custody, or control of the Facebook, Inc. (hereinafter “the Provider”), regardless of 


whether such information is stored, held or maintained inside or outside of the United States, and 


including any emails, records, files, logs, or information that have been deleted but are still 


available to the Provider, the Provider is required to disclose the following information to the 


government for each of the Target Facebook Accounts listed in Attachment A: 


(a) 


(b) 


(c) 


(d) 


All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers. 

All activity logs for the account and all other documents showing the user’s posts 
and other Facebook activities; 

All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 
All profile information; News Feed information; status updates; videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including 
the friends’ Facebook user identification numbers; groups and networks of which 
the user is a member, including the groups’ Facebook group identification numbers; 
future and past event postings; rejected “Friend” requests; comments; gifts; pokes; 


tags; and information about the user’s access and use of Facebook applications; 


ie 
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(e) 


(f) 
(g) 


(h) 
(i) 


0) 
&) 
() 
(m) 
(n) 
(0) 


P) 


(q) 


All other records of communications and messages made or received by the user, 
including all ptivate messages, chat history, video calling history, and pending 
“Friend” requests; 

All records relating to machine cookies; 

All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

All IP logs, including all records of the IP addresses that logged into the account; 
All records of the account’s usage of the “Like” feature, including all Facebook 
posts and all non-Facebook webpages and content that the user has “liked”; 

All information about the Facebook pages that the account is or was a “fan” of; 
All past and present lists of friends created by the account; 

All records of Facebook searches performed by the account; 

All information about the user’s access and use of Facebook Marketplace; 

The types of service utilized by the user; 

The length of service (including start date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

Group identification numbers; a list of users currently registered to the group; a list 
of fens who like the page; group or page contact information, including all contact 
information for the creator and/or administrator of the group and a PDF of the 
current status of the group profile page; 

All past and present Admins for the group; 


The “Creator” of the group; 
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(s) All privacy settings and other account settings, including privacy settings for 
individual Facebook posts and activities, and all records showing which Facebook 
users have been blocked by the account; 

(t) All records pertaining to communications between Facebook and any person 
regarding the user or the user’s Facebook account, including contacts with support 
services and records of actions taken; 

(u) All records related to advertisements and advertising conducted through the 
accounts, including advertisements purchased, advertising parameters (search 
terms, groups, geographic areas) selected and queried. 

B. To the extent that the information described in Attachment A is within the 
possession, custody, or control of the Facebook, Inc. (hereinafter “the Provider”), regardless of 
whether such information is stored, held or maintained inside or outside of the United States, and 
including any emails, records, files, logs, or information that have been deleted but are still 
available to the Provider, the Provider is required to disclose the following information to the 
government for each of the Target Instagram Accounts listed in Attachment A: 

a. All contact and personal identifying information, including full name, user 

identification number, birth date, gender, contact e-mail addresses, physical address 
(including city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers; 

b. All past and current usernames associated with the account, 

c. All activity logs for the account and all other documents showing the user’s posts 


and other Instagram activities; 
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d. The dates and times at which the account and profile were created, and the Internet 


Protocol (“IP”) address at the time of sign-up; 


e. All photos and videos uploaded by that user ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 


f. All profile information; News Feed information; status updates; videos, 


photographs, articles, and other items; Notes; friend lists, including the friends’ and 
followers’ Instagram user identification numbers; groups and networks of which 
the user is amember, including the soins Instagram group identification numbers; 
future and past event postings; tags; 

g. All other records of communications and messages made or received by the user, 
including all private messages, chat history, video calling history, and pending 


“Friend” or “follower” requests; 


h. All records relating to machine cookies; 

i All “check ins” and other location information, including records of the user’s 
latitude and longitude; 

f All IP logs, including all records of the IP addresses that logged into the account; 

k. All records of the account’s usage of the “follow” feature, including all Instagram 


posts and all non-Instagram webpages and content that the user has “liked”; 


L. All past and present lists of friends created by the account; 
m. All records of Instagram searches performed by the account; 
n. The types of service utilized by the user; 
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The length of service (including start date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

All information regarding the particular device or devices used to login to or access 
the account, including device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 

Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
information for the creator salon administrator of the group and a PDF of the 
current status of the group profile page; 

All past and present Admins for the group; 

The “Creator” of the group; 

All privacy settings and other account settings, including privacy settings for 
individual Instagram posts and activities, and all eer showing which Instagram 
users have been blocked by the account; 

All records pertaining to communications between Facebook or Instagram and any 
person regarding the user or the user’s Instagram account, including contacts with 


support services and records of actions taken. 


Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
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U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from March 1, 2016 to the present, including: 


a. 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material: 


All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, = DR 


individual associated with the Trump Campaign, any witness in the investigation; 
Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 


furtherance of the above-listed offenses; 


Fa 
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Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)}—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 


principals. 
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n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 
o. All existing printouts from original storage which concern the categories identified 
in subsection Íl.a. 
I. Review Protocols 
Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 
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ti è y oe Pi 7 
IN THE UNITED STATES DISTRICT COURT SEP 27 2018 


FOR THE DISTRICT OF COLUMBIA ierk, U.S. Disirici & Bankruptey 
Courts for the District a Cuan 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH FOUR 
ACCOUNTS STORED AT PREMISES 
CONTROLLED BY FACEBOOK 


Case: 1:18-sc-02919 

Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 

Description: Search & Seizure Warrant 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Facebook, Inc. (“Facebook”), an electronic communication and/or remote 
computing services provider headquartered in Menlo Park, California, not to disclose the existence 
or contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further jia of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Facebook and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 


attorneys for Facebook for the purpose of receiving legal advice) for a period of one year or until 


THE HONORABL oH A. HOWELL 


CHIEF UNITED STATES DISTRICT JUDGE 


further order of the Court. 
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UNITED STATES DISTRICT COURT = dh EL 
` for the ; 
District of Columbia 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 
INFORMATION ASSOCIATED WITH 


FOUR ACCOUNTS STORED AT PREMISES 
CONTROLLED BY FACEBOOK 


_ Clerk, US. District & Bankruptcy 


Courts for the District of Columbia 


Case: 1:18-sc-02919 
Assigned To : Howell, Beryl A. 


Assign. Date : 9/27/2018. 


Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property to be searched and give its location): 


See Attachment A 


located in the Northern District of 


California 


Pe 


person or describe the property to be seized): 
See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 


i evidence of a crime; 


(A contraband, fruits of crime, or other items illegally possessed; 
ri property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: l 


Code Section 
52 U.S.C. § 30121 
18 U.S.C. §§ 1001, 1030, 371 
See Affidavit for add'l 


The application is based on these facts: 
See attached Affidavit. 


@ Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: 


Foreign Contribution Ban 
False Statements, Unauthorized Access of Protected Computer, Conspiracy 


Offense Description 


under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: 


Kyle R. Freeny (ASC) 


Sworn to before me and signed in my presence. 


YW 271 203 


City and state: Washington, D.C. 


Date: 


SE ee 


, there is now concealed (identify the 


) is requested 


Applicant’s signature 


Patrick J. Myers, Special Agent, FBI __ 


Printed name and title 


Sag. Miu 


Judge's signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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BERL me 


IN THE UNITED STATES DISTRICT COURT 


ot ie te {ya pn 
FILEE 
R 
fA 


Clark, U.S. Dlatrici & Bankruptey 


FOR THE DISTRICT OF COLUMBIA Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF 


INFORMATION ASSOCIATED WITH Case: 1:18-sc-02919 


FOUR ACCOUNTS STORED AT Assigned: 10 P PENS: 

PREMISES CONTROLLED BY a aan ter ge 

FACEBOOK escription: Search & Seizure Warrant 
AFFIDAVIT IN SUPPORT OF 


AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 
L. I make this affidavit in support of an application for a search warrant for 
foon associated with the two Facebook accounts and two Instagram accounts (the “Target 
Accounts”), stored at premises owned, maintained, controlled or operated by F ke Inc. 
(“Facebook”), a sean headquartered in Menlo Park, California. As ai forth below, the Target 


Aceounts are believed to be 


Upon receipt of the information described in Attachment A, government-authorized 


persons will review that information to locate the items described in Attachment B. 

2. I am a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 

3, The facts in this affidavit come from my personal observations, my training and 


experience, and information obtained from other FBI personnel and witnesses. This affidavit is 


ate 
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intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

JURISDICTION | 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)1)(A), & 
(DXA). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 

§ 2711)(A)G). The offense conduct included activities in Washington, D.C., as detailed below. 
PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 
6. ee STONE is a self-employed political strategist/consultant and has been 


actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 


he 
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Donald J. Trump (the “Campaign”) until ass 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
E. to make media appearances in support of the. Campaign. As described further below, 
STONE also maintained contact with individuals employed. by the Campaign, including then- 
campaign chairman Paul MANAFORT and n chairman Rick GATES. 
ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according to publicly available 
information, served as the “Washington Bureau Chief for Inforwars.com.” According to 
publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9.. On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: l 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

-electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

10. Iv its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
sev overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.”” 

I1. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “ijn July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 


and maintained that access until at least June 2016.” The USIC attributed these cyber activities 


to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 


-4- 


Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 19 of 71 


in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guecifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued i engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late . 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud TTT service to move the “snapshots” to 
those accounts. 

16. Onor about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 


elections in numerous Florida counties. 
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18. On July 13, 2018, a grand jury in the District of Columbia returned an ease 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to Saec computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 
C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly alninned responsibility for the DNC hack. It stated 
on its WordPress blog that, with T to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from ; 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is iste: Now the world would 
see for themselves how the Democrats had rigged the game.” 


22. On August 8, 2016, STONE addressed the Southwest Broward Republican 


6- 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to du?” STONE responded: “Well, it could be any number of things. J 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. | 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
. numbers and email addresses from the files of t DCCC. 

24. On August 13, 2016, STONE posted a tweet using @Rogerd Stonelr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, | 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with eon D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 


27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
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soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero. . I think ies taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those andik that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that-of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” | 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” . 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 


32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to RR 2,050 emails that had been hacked from John Podesta’s personal email account. 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
| Day, November 8, 2016. On Gace: 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to -~ 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken. 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and. 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an eal address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disou all came true.” 

D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 


35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
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Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks.' The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct TERR “We appreciate 
that. However, the false claims of association are being used by the democrats to dadene the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November-9, 2016, one day after the presidential election, | 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with seine message less than a minute later: “We are 
now more free to communicate.” 

39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of ve For example, on June 4, 2017, @RogerJStoneJr directly messaged 
T an address associated with ASSANGE in numerous public reports, stating: 

‘“Still nonsense. As a journalist it doesn’t matter wheré you get information only that it is 


accurate and authentic. The New York Times printed the Pentagon Papers which were 


l On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. a 
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indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the tramped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ cide that’s coming most strongly from those obsessed with taking down Trump trying to 
siet us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forumas experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with STONE, | Q Others Regarding 
Forthcoming Leaks 


4i. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE’s m ~: On October 17, 


2017, Chief Judge Howell issued a search warrant for one of STONE’s BB caresses, 


On or about December 19, 2017, Chief Judge Howell issued a search 
warrant for email account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 


search warrants indicated the following: 


42. Onor about May 15, 2016 CORSI: “Here is my flight 
schedule. Need to get something confirmed now... .” CORSI responded, “I copied Roger 


Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 
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appears to have forwarded the message to STONE ToO replied to 


CORSI that, “May mect Manafort -guarantee nothing.” 


43.  Onor about May 18, 2016, CORSI emailed STONE at 


with the title, “Roger -- why don't you look this over before I send it go believe that 


CORSI wrote, 


nd I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

44, On July 25, 2016, STONE, sin i sent an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” 


45. On or about July 31, 2016, STONE, using Do o emailed 


CORSI with the subject line, “Call me MON.” The body ofthe email read: BE stouta see 


Assange[.] | find Bernie [S]anders brother who called Bill a Rapist — turn him for 
Trump[.] | find ae Q more proof of Bill getting kicked out.” 

46. On or about As 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 
| PT “Word is friend in embassy plans 2 more dumps. One shortly after I’m 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me an mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 


campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
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be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke ~- 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. On or about August 5, WA o an associate of STONE’ s, emailed 
STONE at OO A email contained a link to a poll indicating that Clinton - 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” BE N stated to investigators that, around the | 
same time, STONE told him he had gone to London to meet AssANGr DR stated 
that in 201 7, ff STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE To he was joking and 
had not actually met ASSANGE.? | | 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to a to have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 


go in LA?” STONE responded. “It’s this afternoon[.]” The following day, the associate asked, 


“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
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call later — heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

49. On or about August 15, 2016, CORSI emailed STONE at 

SSeS “Give me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. Onor about August 31, 2016, CORSI emailed STONE at 

oe “Did you get the PODESTA writeup.” STONE replied “[y]es.” 

51. On or about August 31, 2016, CORSI iesaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[blerbank, Russia’s largest Deica institution — Pode $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52.  Onor about September 6, 2016, CORSI emailed STONE at 

O ..::: Is NY Post going to use the Pedesta [sic] stuff?” 

| 53. On or about September 24, 1, emailed CORSL “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Ro ger. I saw him again in NYC last Friday and spoke to him about 
it again today” Q back, “Awaiting secret file. Explosive... Hope you are well. | 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators, indicated this 


conversation concerned possible derogatory information he was trying to obtain from Turkey. 
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54. On or about Octébet 3, 2016, an associate of STONE emailed STONE at 
= == and asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. Sec 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 
55. On or about October 4, 2016, ASSANGE gave a press conference at the 
` Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 
56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” . 
57. That same day, BANNON emailed STONE a: “What was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w clintons???” STONE replied, “Don't think so BUT his lawyer — Æ a big 


democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE ~ 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


FE. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. ; 


59, According to a publicly available news article,’ at approximately 11AM on 
` Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

60. According to phone TE at approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. Atapproximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62.  Atapproximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. At approximately 2:18PM, CORSI called STONE and the two spoke for 


approximately twenty minutes. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/31d74714-8ce5-1 1e6-875e-2c] bfe943b66_story-html 


AG: 
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64. | At approximately 4:00PM, the Washington Post published a story regarding the 
ee Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first ies: of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE using aaa “T expect 


that much of next dump focus, setting stage for Foundation debacle.” 
66. At abonel «27 A author who has written about the 
Clinton Foundation, and who, according to emails and phone fesos regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the . 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 
tee | a to CORSI without comment. STONE 
does not appear to have foxwiided the email to any other individual. 


G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


67. Onor about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 
numbers.” | | 

68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
vsing TE 100 Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 


CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Kiei translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at on with the subject 
line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the absent that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

71. On or about Thursday, October 13, 2016, CORSI emailed STONE at 


no “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to 


CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 


post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “PI give you one more — NOBODY YET HAS THIS[:] It looks to me 
like O BA maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank{.] The Russians launched a criminal investigation[.] [web link] Once | 
had the channel open from Metcombank to Deutsche Bank America to Ban{k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 


Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank{.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email ie the subject, “ROGER STONE article | 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same diy STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had nò advance notice about the 
` hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did iit a controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent by O= i: the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other ee It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

TA. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now ~ before 2pm[.]” STONE responded, “Missed u — just 
landed JFK.— on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 
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75, On or about October 17, 2016, CORSI emailed STONE at 
ae A the subject, “Fwd: 

ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.|’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss Hig life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” Based on review of the original eri that CORSI forwarded, the 
“trusted source” was a self-identified retired librarian who gathers information from Batre chat 
rooms. 

. 76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pls call. Important.” 

77. Onor about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
20 16 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 


“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 


` account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 


Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 36 of 71 


Case 1:19-mc-00029-CRC Document 29-26 Filed 04/28/20 Page 37 of 71° 


I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... | 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet.of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. .. . 


[Llet me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 


TKE 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 

encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange, 

you were only referring to a single fact that you had confirmed with the intermediary — 
MR. STONE: That — 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
. 2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. . . . [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.”. | 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’........ Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 


the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
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back, “That was the sani at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — a are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them — which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th].] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted Si perjury[.]” | 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” | | 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 


“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of hne 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ .. . Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December |, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.}* You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth .. . You want me to cover you for perjury 
now{.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for Sth 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you're 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But Pm sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back . . . and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get rae with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 


perjury if you’re stupid enough to testify|.]” 


4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the 
FBI. 
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98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon{.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” | 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs... + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” | 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee . . . But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove ath.) 

103. On or about April 13, 2018, news reports stated that CREDICO had shown _ 


reporters copies of email messages he had received from STONE in the prior few days that 
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stated, “You are a rat. You area stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog aude 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary i 
. . When you start bringing up my dog, you’re crossing the line[.]”° 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.®° In these messages, STONE, on April 9, 2018, 
stated: “I am so ready, Let’s get it on. Prepare to die[.]” In the article, CREDICO sated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer... It was sent in response to that. We talked about it too. 


He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 


have prostate cancer and did not have any such discussion with STONE. 


K. The Target Accounts 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 
é https://www.motherjones.comy/politics/2018/0 5/roger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERNING FACEBOOK 


116. Facebook owns and operates a free-access social networking website of the same 
name that can be accessed at http://www.facebook.com. Facebook allows its users to establish 
accounts with Facebook, and users can then use their accounts to share written news, photographs, 
videos, and other information with other TE users, and sometimes with the general public. 

117. Facebook asks users to provide basic contact and personal identifying information 
to Facebook, either during the registration process or thereafter. This information may include the 
user’s full name, birth date, gender, contact e-mail addresses, Facebook passwords, Facebook 
security questions and answers (for password retrieval), physical address (including city, state, and 
zip code), telephone numbers, screen names, websites, and other personal identifiers. Facebook 
also assigns a user identification number to each account. 

118. Facebook users may join one or more groups or networks to connect and interact 
with other users who are members of the acme group or network. Facebook assigns a group 
identification number to each group. A Facebook user can also T directly with individual 
Facebook users by sending each user a “Friend Request.” If the recipient of a “Friend Request” 
accepts the request, then the two users will become “Friends” for purposes of Facebook and can 
exchange E E or view information about each other. Each Facebook user’s account 
includes a list of that user’s “Friends” and a “News Feed,” which highlights information about the 
user’s “Friends,” such as profile changes, upcoming events, and birthdays. 

119. Facebook users can select different levels of privacy for the communications and 
information associated with their Facebook accounts. By adjusting these privacy settings, a 
Facebook user can make information available only to himself or herself, to particular Facebook 


users, or to anyone with access to the Internet, including people who are not Facebook users. A 
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Facebook user can also create “lists” of Facebook friends to facilitate the application of these 
privacy settings. Facebook accounts also include other account settings that users can adjust to 
control, for example, the types of notifications they receive from Facebook. 

120. Facebook users can create profiles that include photographs, lists of personal 
interests, and other information. Facebook users can also post “status” updates about their 
whereabouts a actions, as wellas links to videos, photographs, articles, and other items available 
elsewhere on the Internet. Facebook users can also post information about upcoming “events,” 
such as social occasions, by listing the event’s time, location, host, and guest list. In addition, 
Facebook users can “check in” to particular locations or add their geographic locations to their 
Pacebook posts, thereby revealing their geographic locations at particular dates and times. A 
particular user’s profile page also includes a “Wall,” which is a space where the user and his or 
her “Friends” can post messages, attachments, and links that will typically be visible to anyone 
who can view the user’s profile. 

121. Facebook allows users to upload photos and videos, which may include any 
metadata such as location that the user transmitted when s/he uploaded the photo or video. It also 
provides users the ability to “tag” (i.e., label) other Facebook users in a photo or video. When a 
user is tagged in a photo or video, he or she receives a notification of the tag and a link to see the 
photo or video. For Facebook’s purposes, the photos and videos associated with a user’s account 
will include all photos and videos uploaded by that user that have not been deleted, as well as all 
photos and videos uploaded by any user that have that user tagged in them. 

122. Facebook users can exchange private HRS on Facebook with other users. 
These messages, which are dali to e-mail messages, are sent to the recipient’s “Inbox” on 


Facebook, which also stores copies of messages sent by the recipient, as well as other information. 
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Facebook users can also post comments on the Facebook profiles of other users or on their own 
profiles; such A n are typically associated with a specific posting or item m the profile. In 
addition, Facebook has a Chat feature that allows users to send and receive instant messages 
through Facebook. These chat communications are stored in the chat history for the account. 
Facebook also has a Video ‘Calling feature, and although Facebook does not record the calls 
kaha it does keep records of the date of each call. 

123. Ifa Facebook user does not want to interact with another user on Facebook, the 
first uset can “block” the second user from seeing his or her account. | 

124. Facebook has a “like” feature that allows users to give positive feedback or connect 
to particular pages. Facebook users can “like” Facebook Boats or updates, as well as webpages or 
content on third-party (i. e., non-Facebook) websites. Facebook users can also become “fans” of 
particular Facebook pages. 

125. Facebook has a search function that enables its users to search Facebook for 
keywords, usernames, or pages, among other things. 

126. Each Facebook account has an activity log, which is a list of the user’s posts and 
other Facebook activities from the inception of the account to the present. The activity log includes 
stories and photos that the user has been tagged in, as well as connections made through the 
account, such as “liking” a Facebook page or adding someone as a friend. The activity log is 
visible to the user but cannot be viewed by people who visit the user’s Facebook page. 

127. Facebook Notes is a blogging feature available to Facebook users, and it enables 
users to write and post ae or personal web logs (“blogs”), or to import their blogs from other 


services, such as Xanga, LiveJournal, and Blogger. 
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128. The Facebook Gifts feature allows users to send virtual “gifts” to their friends that 
appear as icons on the recipient’s profile page. Gifts cost money to purchase, and a personalized 
message can be attached to each gift. Facebook users can also send each other “pokes,” which are 
free and simply result in a notification to the recipient that he or she has been “poked” by the 
sender. 

129. Facebook also has a Marketplace feature, which allows ies to post free classified 
ads. Users can post items for sale, housing, jobs, and other items on the Marketplace. 

130. In addition to the applications described above, Facebook also provides its users 
with access to thousands of other applications (“apps”) on the Facebook platform. When a 
Facebook user accesses or uses one of these applications, an update about that the user’s access or 
use of that application may appear on the user’s profile page. 

131. Some Facebook pages are affiliated with ma of users, rather than one individual 
user. Membership in the group is monitored and regulated by the administrator or head of the 
group, who can invite new members and reject or accept requests by users to enter. Facebook can 
identify all users who are currently registered to $ particular group and can identify the 
administrator and/or creator of the group. Facebook uses the term “Group Contact Info” to 
describe the contact information for the group’s creator and/or administrator, as well as a PDF of 
the current status of the group profile page. 

132. Facebook uses the term “Neoprint” to describe an expanded view of a given user 
profile. The “Neoprint” for a given user can include the following information from the user’s 
profile: profile contact information; News Feed information; status updates; links to videos, 
photographs, articles, and other items; Notes; Wall postings; friend lists, including the friends’ 


Facebook user identification numbers; groups and networks of which the user is a member, 
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including the groups’ Facebook group identification numbers; future and past event postings; 
rejected “Friend” requests; comments; gifts; pokes; tags; and information about the user’s access 
and use of Facebook applications. | 

133. Facebook also retains Internet Protocol (“IP”) logs for a given user ID or IP address. 
These logs may contain information about the actions taken by the user ID or IP address on 
Facebook, including information about the type of action, the date and time of the action, and the 
user ID and IP address associated with the action. For example, if a user views a Facebook profile, 
that user’s IP log would reflect the fact that the user viewed the profile, and would show when and 
from what IP address the user did so. 

134. Social networking providers like Facebook typically retain additional information 
Bout their users’ accounts, such as information about the length of service (including start date), 
the types of service utilized, and the means and source of any payments associated with the service 
(including any credit axe or bank account number). : In some cases, Facebook users may 
communicate directly with Facebook about issues relating to their accounts, such as technical 
problems, billing inquiries, or complaints from other users. Social networking providers like 

Facebook typically retain records about such communications, including records of ee? 
between the user and the provider’s support services, as well as records of any actions taken by 
the provider or user as a result of the communications. 

135. As explained herein, information stored in connection with a Facebook account 
may provide crucial evidence of the “who, what, why, when, where, and how” of the criminal 
conduct under investigation, thus enabling the United States to establish and prove each element 
or alternatively, to exclude the innocent from further suspicion. In my training and experience, a 


Facebook user’s “Neoprint,” IP log, stored electronic communications, and other data retained by 
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Facebook, can indicate who has used or controlled the Facebook account. This “user atiribution” 
evidence is analogous to the search for “indicia of occupancy” while executing a search warrant 
ata RTN For example, profile contact information, private messaging logs, status updates, 
and tagged photos (and the data associated with the foregoing, such as date and time) may be 
evidence of who used or controlled the Facebook account at a relevant time. Further, Facebook 
account activity can show how and when the account was accessed or used. For example, as 
described herein, Facebook logs tie Internet Protocol (IP) addresses from which users access their 
accounts along with the time and date. By demne the physical location associated with the 
logged IP addresses, investigators can understand the chronological and geographic context of the 
account access and use relating to the crime under investigation. Such information allows 
investigators to understand the geographic and chronological context of Facebook access, use, and 
events relating to the crime under investigation. Additionally, Facebook builds geo-location into 
some of its services. Geo-location allows, for example, users to “tag” their location in posts and 
Facebook “friends” to locate each other. This geographic and timeline information may tend to 
either inculpate or exculpate the Facebook account owner. Last, Facebook account activity may 
provide relevant insight into the Facebook account owner’s state of mind as it relates to the offense 
under investigation. For example, information on the Facebook account may indicate the owner’s 
motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or 
consciousness of guilt (e.g., deleting account information in an effort to conceal evidence from 
law enforcement). 

136. Therefore, the computers of Facebook are likely to contain all the material 


described above, including stored electronic communications and information concerning 
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subscribers and their use of Facebook, such as account access information, transaction information, 


and other account information. 


BACKGROUND CONCERNING INSTAGRAM 


137. ioa my review of publicly available information provided by Instagram about 
its service, including Instagram’s “Privacy. Policy,” I am aware of the following about Instagram 
and about the information collected and retained by Instagram. 

138. Instagram is a social networking service PEE by Facebook, Inc. Instagram 
ans and operates a free-access P ERE website of the same name that can be 
accessed at http://www.instagram.com. Instagram allows its users to create their own profile 
pages, which can include a short een a photo of themselves, and other information. Users 
can access Instagram through the Instagram website or by using-a special electronic application 
(“app”) created by the company that allows users to access the service through a mobile device. 

139. Instagram permits users to post photos to their profiles on Instagram and 
otherwise share photos with others on Instagram, as well as certain other social-media services, 
including Flickr, Facebook, ahd Twitter. When posting or sharing a photo ~ Instagram, Je 
can add to the photo: a caption; various “tags” that can be used to search for the photo (¢.g., a 
user made add the tag #vw so that people interested in Volkswagen vehicles can search for and 
find the photo); location information; and other information. A user can also apply a variety of 
“filters” or other visual effects that modify the look of the posted photos. In addition, Instagram 
allows users to make comments on posted photos, including photos that the user posts or photos 


posted by other users of Instagram. Users can also “like” photos. 
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140. Upon creating an Instagram account, an Instagram user must create a unique 
Instagram username and an eee password. This information is collected and maintained by 
Instagram. 

141. Instagram asks users to sais basic identity and contact information upon 
registration and also allows users to provide additional identity information for their user profile. 
This information may include the user’s full name, e-mail addresses, and phone numbers, as well 
as potentially other REET information provided directly by the user to Instagram. Once an 
account is created, users may also adjust various privacy and account settings for the account on 
Instagram. Instagram collects and maintains this information. 

142. Instagram allows ‘ised to have “friends,” which are other individuals with whom 
the user ee share information without making the information public. Friends on Instagram 
may come from either contact lists maintained by the user, other third-party social media 
websites and information, or searches conducted by the user on Instagram profiles. Instagram 
collects and maintains this information. 

143. Instagram also allows users to “follow” another user, which means that they 
receive updates about posts made by the other user. Users may also “unfollow” users, that is, 
stop following them or block the, which prevents the blocked user from following that user. 

144. Instagram allow users to post and share various types of user content, including 
photos, videos, captions, comments, and other materials. Instagram collects and maintains user 
content that users post to Instagram or share through Instagram. 

145. Instagram users may send photos and videos to select individuals or groups via 


Instagram Direct. Information sent via Instagram Direct does not appear in a user’s feed, search 


history, or profile. 
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146. Users on Instagram may also search Instagram for other users or particular types 
of photos or other content. 

147. For each user, Instagram also collects and retains information, called “log file” 
information, every time a user requests access to Instagram, whether through a web page or 
through an app. Among the log file information that Instagram’s servers automatically record is 
the particular web requests, any Internet Protocol (“IP) address associated with m request, type 
of browser used, any N EE web pages and associated URLs, pages viewed, dates and 
times of access, and other information. 

148. Instagram also collects and maintains “cookies,” which are small text files 
containing a string of numbers that are placed on a user’s computer or mobile device and that 
allows Instagram to collect information about how a user uses Instagram. For example, 
Instagram uses cookies to help users navigate between pages efficiently, to remember 
preferences, and to ensure advertisements are relevant to a user’s interests. 

149. Instagram also collects information on the particular devices used to access 
Instagram. In particular, Instagram may record “device identifiers,” which includes data files 
and other information that may identify the particular electronic device that was used to access 
Instagram. 

150. Instagram also collects other data associated with user content. For example, 
Instagram collects any “hashtags” associated with user content (L.e., keywords used), “geotags” 
that mark the location of a photo and which may include latitude and longitude information, 
comments on photos, and other information. 

151. Instagram also may communicate with the user, by email or otherwise. Instagram 


collects and maintains copies of communications between Instagram and the user. 
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152. As explained herein, information stored in connection with an Instagram account 
may provide crucial evidence of the “who, what, sig: when, where, and how” of the criminal 
conduct under investigation, thus enabling the United States to establish and prove each element 
or alternatively, to exclude the innocent from further suspicion. In my training and experience, 
an Instagram user’s account activity, IP log, stored electronic communications, and other data 
retained by Instagram, can indicate who has used or controlled the Instagram account. This 
“user attribution” evidence is analogous to the search for “indicia of occupancy” while executing 
a search java at a residence. For example, profile contact information, direct messaging logs, 
shared photos and videos, and captions (and the data associated with the foregoing, such as geo- 
location, date and time) may be evidence of who used or controlled the Tastan account at a 
relevant time. Further, Instagram account activity can show how and when the account was 
accessed or used. For example, as described herein, Instagram logs the Internet Protocol (IP) 
addresses from which users access their accounts along with the time and date. By determining 
the physical location associated wik the lo SS IP addresses, investigators can understand the 
chronological and geographic context of the account access and use relating to the crime under 
investigation. Such information allows investigators to understand the geographic and 
chronological context of Instagram access, use, and events relating to the crime under 
investigation. Additionally, Instagram builds geo-location into some of its services. Geo- 
location allows, for example, users to “tag” their location in posts and Instagram “friends” to 
locate each other. This geographic and timeline information may tend to either inculpate or 
exculpate the Instagram account owner. Last, Instagram account activity may provide relevant 
insight into the Instagram account owner’s state of mind as it relates to the offense under 


investigation. For example, information on the Instagram account may indicate the owner’s 
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motive and intent to commit a crime (e.g., information indicating a plan to commit a crime), or 
consciousness of guilt (e.g., deleting Acent information in an effort to conceal evidence from 
law enforcement). 

153. Based on the information above, the computers of Instagram are likely to contain 
all the material described above with respect to the Target Instagram Accounts, including stored 
electronic communications and information concerning subscribers and their use of Instagram, 
such as account access information, which would include sformaaan such as the IP addresses 
and devices used to access the account, as well as other account information that might be used 
to identify the actual user or users of the account at particular times. 

FILTER REVIEW PROCEDURES 

154. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and . 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

155. Based on the forgoing, I request that the Court issue the proposed search warrant. 

156. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. . 

| REQUEST FOR SEALING 

157. I further request that the Court order that all papers in support of this application, 

including the affidavit and search warrant, be sealed until further order of the Court. These 


documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
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known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


Patrick J. Myers 
Special Agent 
‘Federal Bureau of Investigation 


Subscribed and sworn to before me on this A day of September, 2018. 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the Facebook accounts registered to 
the following email addresses (“Target Facebook Accounts”), stored at premises owned, 
maintained, oiialiod or operated by Facebook, Inc. (“Facebook”), a company headquartered in 


Menlo Park, California: 


This warrant also applies to information associated with the Instagram accounts registered 
to the following email addresses (“Target Instagram Accounts”), stored at premises owned, 


maintained, controlled, or operated by Facebook: 
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I 


ATTACHMENT B 


I. Information to be disclosed by Facebook/Instagram 


A. 


To the extent that the information described in Attachment A is within the 


possession, custody, or control of the Facebook, Inc. (hereinafter “the Provider”), regardless of 


whether such information is stored, held or maintaincd inside or outside of the United States, and 


including any emails, records, files, logs, or information that have been deleted but are still 


available to the Provider, the Provider is required to disclose the following information to the 


government for each of the Target Facebook Accounts listed in Attachment A: 


(a) 


(b) 


(©) 


(d) 


All contact and personal identifying information, including full name, user 
identification number, birth date, gender, contact e-mail widens: physical address 
(including city, state, a zip code), telephone numbers, screen names, websites,- 
and other personal identifiers. 

All activity logs for the account and all other documents showing the user’s posts _ 
and other Facebook activities; 

All photos and videos uploaded by that i886 ID and all photos and videos uploaded 
by any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 

All profile information; News Feed information; status updates; videos, 
photo graphs, articles, and other items; Notes; Wall postings; friend lists, including . 
the friends’ Facebook user identification numbers; groups and networks of which 
the user is a member, including the groups’ Facebook group identification numbers; 
future and past event postings; rejected “Friend” requests; comments; gifts; pokes; 


tags; and information about the user’s access and use of Facebook applications; 
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(e) 


co) 
(g) 


(h) 
G) 


© 
(k) 
O 

(m) 
(a) 
(0) 


(p) 


(q) 
(r) 


All other records of communications and messages made or received by the user, 
including all private messages, chat fete video calling history, and pending 
“Friend” egies 

All records relating to machine cookies; 

All “check ins” and silia location information, including records of the user’s 
latitude and longitude; 

All IP logs, including all records of the IP addresses that logged into the account; 
All records of the account’s usage of the “Like” feature, including all Facebook 


posts and all non-Facebook webpages and content that the user has “liked”, 


_ All information about the Facebook pages that the account is or was a “fan” of; 


All past and present lists of friends created. by the account; 

All eo of Facebook searches performed by the account; 

All information about the user’s access and use of Facebook Marketplace; 

The types of service utilized by the user; 

The length of service (including start date) and the means and source of any 
payments associated with the service (including any credit card or bank account 
number); 

Group identification numbers; a list of users currently registered to the group; a list 


of users who like the page; group or page contact information, including all contact 


information for the creator and/or administrator of the group and a PDF of the 


current status of the group profile page; 
All past and present Admins for the group; 


The “Creator” of the group; 


Be 
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(s) 


© 


(u) 


B. 


All privacy settings and other account settings, including privacy settings for 
individual Facebook posts and activities, and all records imine which Facebook 
users have been blocked by the account; 

All records pertaining to communications between Facebook and any person 
regarding the user or the user’s Facebook account, including contacts with support 
services and records of deta taken; 

All records related to advertisements and advertising dide through the 
accounts, including advertisements purchased, advertising parameters (search 
terms, groups, geographic areas) selected aut queried: 


To the extent that the information described in Attachment A is within the 


possession, custody, or control of the Facebook, Inc. (hereinafter “the Provider”), regardless of 


whether such information is stored, held or maintained inside or outside of the United States, and 


including any emails, records, files, logs, or information that have been deleted but are still 


available to the Provider, the Provider is required to disclose the following information to the 


` government for each of the Target Instagram Accounts listed in Attachment A: 


a. 


All contact and personal identifying information, including full name, user 
identification amber birth date, gender, contact e-mail addresses, physical address 
Gnudi city, state, and zip code), telephone numbers, screen names, websites, 
and other personal identifiers; 

All past and current usernames associated with the account; 

All activity logs for the account ad all other documents showing the user’s posts 


and other Instagram activities; 
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d. The dates and times at which the account and profile were created, and the Internet 
Protocol (“IP”) address at the time of sign-up; . 

oH All photos and videos uploaded by that user ID and all photos and videos uploaded 
- any user that have that user tagged in them, including Exchangeable Image File 
(“EXIF”) data and any other metadata associated with those photos and videos; 

£. All profile information; News Feed information; status updates; videos, 
photographs, articles, and other OR Notes; fiend lists, including the friends’ and 
followers’ Instagram user identification numbers; groups and networks of which 
the user is a member, including the E Instagram group identification numbers; 
future and past event postings; tags; 

g. All other records of communications and messages made or received by the user, 
including all paves messages, chat history, video calling history, and pending 


“Friend” or “follower” requests; - 


h. All records relating to machine cookies; 

i Al “check ins” and other location information, including records of the user’s 
latitude and longitude; 

j. -AI TP logs, including all records of the IP addresses that logged into the account; 


k. All records of the account’s usage of the “follow” feature, including all Instagram 
posts and all non-Instagram webpages and content that the user has “liked”; 
L All past and present lists of friends created by the account; 
? 


m. All records of Instagram. searches performed by the account; 


n. The types of service utilized by the user; 


5. 


II. 
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The length of service (including start date) and the means and source of any 


payments associated with the service (including any credit card or bank account 


number); 


` 


AH information regarding the particular device or devices used to login to or access 
the account, including device identifier information or cookie information, 
including all information about the particular device or devices used to access the 
account and the date and time of those accesses; 

Group identification numbers; a list of users currently registered to the group; a list 
of users who like the page; group or page contact information, including all contact 
hoidon for the creator and/or aeui of the o and a PDE of the 
current status of the group profile page; 

All past and present Admins for the group; 

The “Creator” ofthe group; 

All privacy settings and other account settings, including privacy settings for 
individual Instagram posts and activities, and all E showing which Instagram 
users have feei biked by the account; 

All records pertaining to communications between Facebook or Instagram and any 
person regarding the user or the Ida Instagram account, including contacts with 


support services and records of actions taken. 


Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
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U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from March 1, 2016 to the present, including: 


a. 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities nel with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material: 


All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, Julian 


Assange, Randy Credico, any 
individual associated with the Trump Campaign, any witness in the investigation; 
Communications, records, documents, and éther files related to any expenditure, 
independent eect or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any ioe 
government, foreign officials, foreign ‘entities, foreign persons, or foreign 
principals; — 

All EM messages, communications, calendar entries, search terms, “address 


book” entries and contacts, including any and all preparatory steps taken in 


furtherance of the above-listed offenses; 


Eris 
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f. 


Communications, SEA documents, and other files that reveal efforts by any 
person to conduct activities ọn behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; | 

Evidence indicating how and when the account was es or uscd, to determine 
the geographic and chronological context of açcount access, use, and events relating 
to the crimes under investigation and to the account owner; 

Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation, 
The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; | 
The identity of any non-U.S. person(s) —including records that help reveal the | 
whereabouts of the person(s)—who made any expenditure, independent 
E TA or disbursement for an electioneering communication; and 

The identity of any person(s)}—including records that help reveal the whereabouts 
of the person(s}—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for ihe benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 


principals. 


28. 
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n. Passwords and encryption keys, and other access tien that may be necessary 
to access the account and other associated accounts; 
ee All existing printouts from original storage which concern the categories identified 
in subsection H.a. 
IM. Review Protocols 
Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02919 

INFORMATION ASSOCIATED WITH FOUR Assigned To : Howell, Beryl A. 
ACCOUNTS STORED AT PREMISES Assign. Date : 9/27/2018 
CONTROLLED BY FACEBOOK Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 


- TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in supat thereof (collectively herein the “Warrant”) under seal, and precluding the provider from. 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non- 
disclosure, the proposed Order would direct Facebook, Inc. (“Facebook”), an electronic 
communication and/or remote computing services provider headquartered in Menlo Paie 
California, not to notify any other person (except attorneys for Facebook for the purpose of 
receiving legal advice) of the existence or content of the Warrant for a period of one year or until 
further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 

7 The Court has the inherent power to seal Suite filings when appropriate, 
` including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

PM Tn addition, this Court has jurisdiction to issue the requested order because it is “a 


court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 
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“district court of the United States . . . that — has jurisdiction over the offense being investigated.” 
18 U.S.C. § 2711G3)(A)G). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Facebook provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(@2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Facebook may be 
compelled to supply E E and other records using a subpoena, court order, or search 
warrant. Specifically, ee 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 

“noton information asg a court order, and Section 2703(a)-(b)(1)(A) allows the 

Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 
Section 2705(b) of the SCA enables the Government to obtain a court order is preclude such 
notification. In relevant part, Section 2705(b) provides as follows:' 

(b) Preclusion of notice to subject of governmental access. — A governmental 

entity acting under section 2703 ... may apply to a court for an order commanding 

a provider of electronic communications service or remote computing service to 

whom a warrant, subpoena, or court order is directed, for such period as the court 

deems appropriate, not to notify any other person of the existence of the warrant, 

subpoena, or court order. The court shall enter such an order if it determines that 


there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 


! Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. l 
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(1) endangering the life or physical safety of an individual; 
(2) flight from prosecution; - 
(3) destruction of or tampering with evidence; 
(4) intimidation of potential witnesses; or 
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 
requisite showing about potential consequences of notification: 
The explicit terms of section 2705(b) make clear that ifa courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 


government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 


In re Application for Order of Nondisclosure Pacey to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ201403 1422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Facebook not to notify ay other person (except attorneys for Facebook for the purpose 
of receiving ei advice) of the existence of the Subpoena for a period of one year aui further 
order of the Court. 


FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. The Federal Bureau of Investigation (“F BP’) is investigating, among other things, 
violations of 18 U.S.C. § 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. 
§ 4 (misprision of a felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an 
unregistered foreign agent), 18 U.S.C. § 1030 (unauthorized access of a protected computer); 
18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), 
and 22 U.S.C. § 611 et seq. (Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign 


contribution ban) (the “Subject Offenses”), in connection with efforts to compromise the networks 


3 
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of the Democratic National Convention (“DNC”), the Democratic E Campaign 
Committee (“DCCC”), and the email accounts of US. persons involved in the 2016 presidential 
election, followed by the public release of stolen materials through various outlets. 

7. In this matter, the government requests that the Warrant be sealed until further order 
ofthe Court and that Facebook and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Facebook for the purpose of receiving 
legal ae for a period of one year or until further order of the Court. Such an order is 
appropriate because the Warrant relates to an ongoing criminal investigation, the S and nature 
of which is neither public nor known to the targets of the investigation, and its disclosure may alert 
these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant 
and related papers may also alert the targets to the scope of information known to the FBI. Once 
alerted to this information, potential targets would be immediately prompted to destroy or conceal 
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic communication and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 

and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the ‘next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 

9, There is, therefore, reason to believe that notification of the existence of the 


Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
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to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there i exists a 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Facebook, the United States is aware that, absent a 
court order under Section 2705(b) commanding Facebook not to notify anyone about a legal 
request, Facebook may, upon receipt of a warrant seeking the contents of electronically stored te 
or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other ited materials be placed under seal, and furthermore, that the Court command 
Facebook not to notify any other person of the existence or contents of the above-captioned warrant 
(except dees for Facebook for the purpose of receiving legal advice) for a period of one year 
or until further order of the Court. 

Respectfully submitted, 


ROBERT S. MUELLER, IN 
Special Counsel 


Dated: 2/24/10 By: 


The Special Counsel’s Office 
(202) 616-3812 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 


In the Matter of the Search of ) 
(Briefly describe the property to be searched ) rae q1: 18-sc-02929 
or identify the person by name and address) ) ssigned To: Ho 
well, Be 
) ryl A. 
) 


INFORMATION ASSOCIATED WITH THREE Assign. Date - 9/27/2018 
ACCOUNTS STORED AT PREMISES escription: Search & S 
CONTROLLED BY MICROSOFT eizure Warrant 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Western District of Washington 


(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before October 11, 2018 (not to exceed 14 days) 
in the daytime 6:00 a.m. to 10:00 p.m. Ù at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon, Beryl A. Howell, Chief U.S. District Judge 
(United States Magistrate Judge) 


CI Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for___ days (not to exceed 30) C until, the facts justifying, the later specific date of 


Date and time issued: Ff LF/ Za/ x af g osf A EAA he z eC” 


anes S signatur e 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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Return 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Microsoft accounts, 
stored at premises owned, maintained, controlled, or operated by Microsoft Corporation 


(“Microsoft”), a company headquartered in Redmond, Washington: 


This warrant also applies to information associated with the following Skype usernames 
and/or email addresses, stored at premises owned, maintained, controlled, or operated by Microsoft 
Corporation, an electronic communication and/or remote computing service provider with 


headquarters in Redmond, Washington: 
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ATTACHMENT B 


I. Information to be disclosed by Microsoft 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of the Microsoft Corporation (hereinafter “the Provider”), regardless of whether 


such information is stored, held or maintained inside or outside of the United States, and including 


any emails, records, files, logs, or information that have been deleted but are still available to the 


Provider, the Provider is required to disclose the following information to the government for each 


account or identifier listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

The contents of all Skype communications sent to or from the account, including 
videos, instant messages, group messages, and attachments, as well as the complete 
conversation history for the account, 

All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session dines and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 


The types of service utilized; 
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All Windows Live and OneDrive data and content; 

All Microsoft Developer information and content and any other information and 
content relating to software development and testing; 

All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 


actions taken; 


` All Lync content; 


All subscriber “change history” associated with the account; 

All search history and web history associated with the account (including Bing 
history); 

All location and maps information associated with the account; 

All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 
Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (IMSI”), or 
International Mobile Equipment Identities (“IMEL”); and 

For any accounts linked to the accounts listed in Attachment A, including accounts 


linked by cookie, SMS number, or recovery email address, and for accounts for 


3. 
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which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 


source of payment (including any credit or bank account number). 


Il. Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C, § 30121 (foreign contributions ban) for the 


period from March 1, 2016 to the present, including: 


a. 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 


or other obfuscation about knowledge of, or access to, hacked material; 


-4- 
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Al records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome cor ë ë D 


individual associated with the Trump Campaign, any witness in the investigation; 
Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

Communications, records, documents, and other files that reveal efforts by any 
person to conduct etic on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 
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j. Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account, 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

1. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)}—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

0. All existing printouts from original storage which concern the categories identified 
in subsection Ila. 

HI. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 
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PIL 

: apie & x 5 

IN THE UNITED STATES DISTRICT COURT SEP 2 7 208 
FOR THE DISTRICT OF COLUMBIA Clerk, U.S, Digtrlet & Bankruptcy 


Courts for the District of Calumbla 


IN THE MATTER OF THE SEARCH OF 


INFORMATION ASSOCIATED WITH Case: 1:18~sc~02920 

THREE ACCOUNTS STORED l Assigned To : Howell, Beryl A. 

AT PREMISES CONTROLLED BY Assign. Date : 9/27/2018 

MICROSOFT CORPORATION Description: Search & Seizure Warrant 
ORDER 


The United Sintes has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Microsoft Corporation (“Microsoft”), an electronic communication and/or remote 
computing services provider headquartered in Redmond, Washington, not to disclose the existence 
or contents of the Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the DEN EA PR and affidavit in support thereof, all attachments thereto and other related 


materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Microsoft and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 


attorneys for Microsoft for the purpose of receiving legal advice) for a period of one year or until 


THE HONORABL LIfe A. AAL 


CHIEF UNITED STATES DISTRICT JUDGE 


further order of the Court. 


MELA 


Date 
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UNITED STATES DISTRICT COURT FILED 
for the SEP 9 7 28 


District of Columbia 
Clerk, U.S. District & Bankruptcy 
Gouits for tha Dlewlet of Oaea -e 
Case: 1:18~sc-02920 
Assigned To : Howell, Beryl A. 
Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH 
THREE ACCOUNTS STORED AT PREMISES 
CONTROLLED BY MICROSOFT 


APPLICATION FOR A SEARCH WARRANT 


I, a federal Jaw enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 


property io be searched and give its location): 


See Attachment A f 
located in the Western District of Washington ___, there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(¢) is (check one or more): 
M evidence of a crime; 
contraband, fruits of crime, or other items illegally possessed; 
M property designed for use, intended for use, or used in committing a crime; 
C a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
§2 U.S.C. § 30121 Foreign Contribution Ban 
18 U.S.C. §§ 1001, 1030,371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 
The application is based on these facts: 
See attached Affidavit. 


A Continued on the attached sheet. ; 
Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. — 


Applicant’s signature 


Patrick J. Myers, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. ` 


Date: Gf epad LAO Lew LA 


Judge's signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 


City and state: Washington, D.C. 
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: pone , SEP 2 7 2018 
IN THE UNITED STATES DISTRICT COURT ieee ie T 
FOR THE DISTRICT OF COLUMBIA Court fore DAML OF Cala 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
THREE ACCOUNTS STORED AT 
PREMISES CONTROLLED BY 
MICROSOFT 


Case: 1:18-sc-02920 

Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 

Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 


INTRODUCTION AND AGENT BACKGROUND 


f; I make this affidavit in support of an application for a search warrant for 


‘information associated with the Microsoft email account PE “Target 
Accounts 1”) and the Skype accounts registered to ee W% Account 


2”) and il ee Account 3”), stored at premises’ owned, 


maintained, controlled or operated by Microsoft Corporation (“Microsoft”), a company 


headquartered in Redmond, Washington. 


Upon receipt of the information described in Attachment A, government-authorized persons will 


_teview that information to locate the items described in Attachment B. 
2. Iam a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. 1 have been a Special nash 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 


security investigations relating to foreign intelligence and cybersecurity. 


ce 
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3: The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. | 

4, Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fend): 18 U.S.C. §§ 1505 and 1512 (obsiruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)A)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 

J URISDICTION 
. 5. This Court has jurisdiction to issue the requested warrant because it is “a eke 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), EXIXA), & 
(c)(1)(A). ‘Specifically, the Court is “a district court of the United States (including a magistrate 


judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 


§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 
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PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 

6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and dn chairman Rick GATES. 

ii. Jerome CORSI 

7. Jerome CORSI is a political commentator who, according i publicly available 
information, served as the “Washington Bureau Chief for Inforwars.com.” According to 
publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by. WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election 


9, On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 


intermediaries, and paid social media users or ‘trolls. 


Th With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 


fs 
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services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[iJn July 
2015, Russian iol sence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 
| 12. With respect to the release of stolen materials, the USIC assessed “with high 

confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13.  Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to. the 2016 presidential geen through at 
least November 1, 2016. | 

15. For example, in or around September 2016, these individuals successfully gained . 


access to DNC computers housed on a third-party cloud-computing service. In or around late 


September, these individuals stole data from these cloud-based computers by creating backups of 


the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
‘used three new accounts with the same cloud computing service to move the “snapshots” to 


those accounts. 


16. On or about September 4, 2016, individuals associated with the GRU stole the 


emails from a former White House advisor who was then advising the Clinton Campaign. These 


-5- 
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emails were later post on DCLeaks. 
17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 
18.. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125), | 
C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 
19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the meda reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC ddinam, 
20. _— On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
| the DNC. 
21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The aik stated: “Tt doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 


and stated: “Here’s Guccifer 2.0’s website. Have a look and you'll see he explains who he is and 


Æ: 
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why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful oH wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” | 

22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what J ulian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could-be any number of things. | 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” À few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been nies from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to-@RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 


26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
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resigned as Chairman of the Trump Gipson Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @Roger! StoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston. Herald 
- Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Sanday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez, 
tweeted regarding an announcement AS SANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 


to tweet: “Payload coming. #Lockthemup.” 
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31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 


“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 


to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 


33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to de: I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
{[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
hia with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted, I hear that through my emissary.” 

34. On March 27, 201 7, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 


charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
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or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 
D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 
35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks.! The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 


national TV, cable and print defending WikiLeaks and assange against the claim that you are 


Russian agents and debunking the false charges of sexual assault as trumped up bs you may want . 


to rexamine the strategy of attacking me- cordially R.” 


36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 


that. However, the false claims of association are being used by the democrats to undermine the _- 


impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 20 16, @RogerJStoneJr sent a direct eae to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 


now more free to communicate.” 


39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 


! On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
E an address associated with ASSANGE in numerous public reports, stating: - 
“Still nonsense. As a journalist it ei matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards, R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@IJulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you ah WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with STONE, i ond Others Regarding 
Forthcoming Leaks 


41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for Xa go O On October 17, 


2017, Chief Judge Howell issued a search warrant for one of Sre EA 


On or about December 19, 2017, Chief Judge Howell issued a search 


warrant for email account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 


search warrants indicated the following: 


“ti 
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42. Onor about May 15, 2016 N CORSI: “Here is my flight 


schedule. Need to get something confirmed now . . . .” CORSI responded, “I copied Roger 
. Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 


appears to have forwarded the message to STONE at ay replied to 


CORSI that, “May meet Manafort -guarantee nothing.” 


43.  Onor about May 18, 2016, CORSI emailed STONE iii _ 


with the title, “Roger -- why don't you look this over before I send 7 I believe that 


CORSI wrote, 


and I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 
44. On July 25, 2016, STONE, w g an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails. ..they deal with 
. eile aba aliceediy 
45.  Onor about July 31, 2016, STONE, using as emailed 
CORSI with the subject line, “Call me MON.” The body of the email read: | aa see 
Assange[.| | find Bernie [S]anders brother who called Bill a Rapist — turn him for 
Trump]. | a should find 0 Q more proof of Bill getting kicked out.” 
46. On or about August 2, 2016 (approximately 19 days before STONE publicly 


tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 


O K is friend in embassy plans 2 more dumps. One shortly after Pm 


back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
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will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine'to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now dar Would not hurt to start suggesting HRC old, memory bad, has stroke -- 
neither he idi she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. On or about August 5, 2 g associate of STONE’s, emailed 
STONE ie email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” a stated to investigators that, around the 
same time, STONE told him he had gone to London to meet ASSANGE. en also stated 
that in 201 mi told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told a: was joking and 
had not actually met ASSANGE.? 

48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Anpas for one or more meetings at the time that he claimed, 


in his email to ae! to have “dined” with ASSANGE. For example, an associate of 


See 
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STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did u meeting 
go in LA?” STONE testonded: “It’s this afternoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
call later — heading for airport now[.]” Additionally, investigators have identified a photograph in 
S'TONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
PE indicating that it was taken in Los Angeles. 

49. On or about August 15, 2016, CORSI emailed STONE at. 

Ooo me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. Pm in NYC this week. Jerry.” 

50. On or about August 31, 2016, CORSI emailed STONE at 
o= g you get the PODESTA writeup.” STONE replied “[y]es.” 
51. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
Sfb]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 
52. Onor about September 6, 2016, CORSI saeied STONE at 
O ....:: Is NY Post going to use the Pedesta [sic] stuff?” 
53. On or about September 24, 2016, ŒE CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 


it again today.” J wrote back, “Awaiting secret file. Explosive... Hope you are well. 
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Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted. 
about file[.|” In a subsequent meeting with investigators, po indicated this 
conversation concerned possible derogatory information he was trying to obtain a Turkey. 

54. On or about October 3, 2016, an associate of STONE emailed STONE at 

Oo B “Assange — what’s he got? Hope it’s good.” STONE wrote 

back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I'd say that’s 
important.” | 

55. — On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in EIE leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 


not make any new releases. Instead, ASSANGE promised more documents, including 


information “affecting three powerful organizations in three different states, as well as, of course, _ 


information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. | Onor about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has niae or he would have released it. Total BS hype.” 


57. That same day, BANNON emailed STONE a o- was 


that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
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to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his lawyer [J is a big 
democrat.” 

58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that ieas asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSAN GE, and 
BANNON had been hoping for releases of damaging aona that morning. 


F. STONE and CORSI Communications on October 7,2016, when the Podesta Emails 
‘Are Released. 


59, According to a publicly available news article,’ at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 


60. According to phone records pe at approximately 


11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 


61. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 


62.  Atapproximately 1:42PM, STONE called CORSI and the two spoke for 


approximately seventeen minutes. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 1d74714-8ce5-11e6-875e-2c1 bfe943b66_story.html 
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63.  Atapproximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. | 

64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. | 

65.  Atapproximately 4:30PM, WikiLeaks tweeted out its first release of ank 
haked from Jobn Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE using ee: “I expect 


that much of next dump focus, setting stage for Foundation debacle.” 

66. Atapproximately 6:27PM, En an author who has written about the 
Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
naaa Podesta emails. Approximately ten minutes later, STONE, wane 
fio ay forwarded E] message to CORSI without comment. STONE 
does not appear to have forwarded the email to any other individual. 


G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, akne bad job 


numbers.” 


68. Onor about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 


—_ | emailed Corsi asking him to “send me your best podesta links.” 


STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
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CORSI wrote back at A 8:54AM EDT, “Ok. Monday. The remaining stuff on 
` Podesta is complicated. Two articles in length. I can give you in raw T the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69, On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at both pi the subject 
line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russie novenniedt money laundering operation that benefits 
Haancially, Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

7L On or about Thursday, October 13, 2016, CORSI emailed STONE at 

= B -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “PI give you one more — NOBODY YET HAS THIS[:] It looks to me 
like | O maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once el 
had the channel open from tater to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 


Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank].] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. Onor about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email at oo with the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE diote: “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did E a controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, oda through 
Metcombank, a Russian regional bank owned 99.978 percent vy Q the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” | 

73. On or about October 14, 2016, CORSI sent a message to STONE at bis iCloud 
account, “I’m in NYC. Thinking about wilting piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

TA. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.}’ STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 
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75, ` On or about October 17, 2016, CORSI emailed STONE at 
ASSANGE... URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yesf[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff sind 
raised him the election.” Based on review of the original email that CORSI forwarded, the 
“trusted source” was a self-identified retired librarian who gathers information from public chat 
rooms. 

76.  Onor about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pls call. Important.” | 

77. Onor about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI ee STONE at his iCloud account, 


“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks . 


88. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. . . . 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 


YES 
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89, Ina document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCL 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 

encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange, 

you were only referring to a single fact that you had confirmed with the intermediary — 

MR. STONE: That — 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails... . [Mly tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

91. Onor about November 19, 2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “Stonewall it. Plead the fifth. Anything to 
save the plan’........ Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 


the house committee lawyer told my lawyer that I will be getting a subpoenal.|” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing _ 
happening in DC the day before Thanksgiving — why E u busting my chops?” 

93. — Onor about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with jiin is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them — which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stufff.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th{.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” | 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 


“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 


5. 
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confirmed for Mr, Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . . . Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t kow why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what headache[.]* You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no bak ana and you could have just told the truth... You want me to cover you for perjury 
now[.]” STONE pned “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back .. . and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If | 
you testify you’re a fool. Because of tromp [sic] I could never get ee with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 


perjury if you’re stupid enough to testify[.]” 


t Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the 
FBL 
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98. STONE and CREDICO continued to message each other on or about December |, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and a your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99, Onor about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter, 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardonf.]” CREDICO 
‘messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial settee | 

101. On or about January 8, 2018, CREDICO messaged STONE, stating? “Embassy - 
logs . . .+ 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee . . . But you'll ja 
_ off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I es 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 


reporters copies of email messages he had received from STONE in the prior few days that 
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stated, “You are arat. You are a stoolie. You backstab your friends ~~ run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
À When you start bringing up my dog, you’re crossing the linef. J’? 

104. On or about. May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.® In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 
He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 


have prostate cancer and did not have any such discussion with STONE. 


K. The Target Accounts 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 
6 hitps://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERNING MICROSOFT 


115. In my training and experience, J have learned that Microsoft provides a variety of 


online services, including electronic mail (“email”) access, voice communications services such 
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as Skype, Windows Live services, cloud storage services auth as OneDrive, and software 
development kit accounts, to the publie: Subscribers obtain any of ies types of accounts by 
registering with Microsoft. During the registration process, Microsoft asks subscribers to provide 
basic personal information. Therefore, the computers of Microsoft are likely to contain stora 
sieetonk communications (including retrieved and unretrieved email for email subscribers and 
information concerning subscribers and their use of email services, such as account access 
information, email transaction information, and account application information. In my training 
and experience, such information may constitute iene of the crimes under investigation 
because the information can be used to identify the account’s user or users. 

116. In my training and experience, email providers oenetally ask their subscribers to 


provide certain personal identifying information when registering for a services account. Such 


information can include the subscriber’s full name, physical address, telephone numbers and other - 


identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 


‘Gncluding any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

117. — In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on theirt systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(ie., session) times and durations, the types of service utilized, the status of the account (including 


whether the account is inactive or closed), the methods used to connect to the account (such as 


Bie 
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logging into the account via the provider’s website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the: Internet Protocol address 
GTP address”) used to register the account and the IP addresses associated with particular logins 
to the sept Because every device that connects to the Internet must use. an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

118. In my training and experience, in some cases, account users will PR 
directly with a service provider about issues relating to the account, such as technical problems, 
billing inquiries, or complaints from other users. Providers typically retain records about such 
communications, including records of contacts between the user and the provider’s support 
services, as well as records of any actions taken by the provider or user as a result of the 
communications. In my training and experience, such information may constitute evidence of the 
crimes under investigation because the information can be used to identify the account’s user or 
users. | 

119. This application seeks a warrant i search all responsive records and information 
under the control of Microsoft, a provider subject to the jurisdiction of this court, regardless of 
where Microsoft has chosen to store such information. The government intends to require the 
disclosure pursuant to the requested warrant of the contents of wire or electronic communications 
and any records or other information pertaining to the customers or subscribers if such 
communication, record, or other information is within Microsoft’ s possession, custody, or control, 
regardless of whether such communication, record, or other information is stored, held, or 
maintained outside the United States. Itis my sadersianding that Microsoft has access to email 


accounts with the top level domain .au, which is associated with Australia. 
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120. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduet 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from inie suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. For example, email 
communications, contacts lists, and images sent (and the data associated with the foregoing, such 
as date and time) may indicate who used or controlled the account at a relevant time. Further, | 
information maintained by the email provider can show how and when the account was accessed 
or used. For example, as described below, email providers typically log the IP addresses from | 
which users access the email account, along with the time and date of that access. By 
determining the physical location associated with the logged IP addresses, investigators can 
understand the chronological and geographic context of the email account access and use relating 
to the crime under investigation. This geographic and fimeline information may fetid to either 
inculpate or exculpate the account owner. Additionally, information stored at the user’s account 

| may further indicate the geographic location of the account user at a particular time (e.g., 
location information integrated into an image or video sent via email). Last, stored electronic 
data may provide relevant insight into the email account owner’s state of mind as it relates to the 

- offense under investigation. For example, information in the email account may indicate the 
owner’s motive and intent to commit a crime (e.g., communications relating to the crime), or 
consciousness of guilt (e. g., didie communications in an effort to conceal them from law 


enforcement). 
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FILTER REVIEW PROCEDURES 

121. Review of the items described in adre A and Attachment B will be 
conducted pursuant a established procedures designed to collect evidence in a manner consistent 
watt professional responsibility requirements concerning the maintenance of omerale and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 

122. Based on the forgoing, I request that the Court issue the proposed search warrant. 

123. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 
required for the service or execution of this warrant. 

REQUEST FOR SEALING 

124. I further request that the Court order that all papers in support of this application, 
including the affidavit ad search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full re and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


< a J. Myers 


Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this 27, of September, 2018. 


446 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following Microsoft accounts, 
stored at premises owned, maintained, soutvolled: or operated by Microsoft Corporation 


(“Micrusult”), a company headquartered in Redmond, Washington: 


This warrant also applies to information associated with the following Skype usernames 


and/or email addresses, stored at premises owned, maintained, controlled, or operated by Microsoft 


Corporation, an electronic communication and/or remote computing service provider with - 


headquarters in Redmond, Washington: 
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ATTACHMENT B 


I. Information to be disclosed by Microsoft 


To the extent that the information described in Attachment A is within the possession, ` 


custody, or control of the Microsoft Corporation (hereinafter “the Provider”), regardless of whether 


such information is stored, held or maintained inside or outside of the United States, and including 


any emails, records, files, logs, or information that have been deleted but are still available to the. 


Provider, the Provider is required to disclose the following information to the government for each _ 


account or @dentifier listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 


copies of emails sent to. and from the account, draft emails, the source and 


destination addresses associated with each email, the date and time at which each 


email was sent, and the size and length of each email; 

The contents of all Skype communications sent to or from the account, including 
videos, instant messages, group messages, and attachments, as well as the complete 
conversation history for the account; 

All records or other information regarding the identification of the account, to 
sacle full name, physical address, telephone numbers. and other identifiers, 
records of session ee and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 


The types of service utilized; 
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which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, isa address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided ee registration, eoa of connecting, log files, and means and 


source of payment (including any credit or bank account number). 


I. Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. $ 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from March 1, 2016 to the present, including: 


a. 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 


or other obfuscation about knowledge of, or access to, hacked material; 
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All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, ed Julian 


individual associated with the Trump Campaign, a witness in the investigation; 
Communications, records, documents, and other files related to any expenditure, 
` independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
_ government, foreign officials, foreign entities, foreign persons, or TETA 
principals; 

All images, TTA communications, calendar entries, search terms, “address: 
book” entries and contacts, including any and all preparatory steps taken in 
E EN of the above-listed offenses; 

Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; | 
Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 


5. 


TI. 


pursuant to established procedures designed to collect evidence in a manner consistent with’ 
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j. 


k. 


Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

AH images, messages and communications regarding ne software, encryption 
or other abod to avoid detection by law enforcement; 

The identity of any ond: person(s)—including records that help reveal the 
whereabouts . of the person(s)}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)-—-who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. | 
Passwords and encryption keys, and other A information that may be necess ary 
to access the account and other associated accounts; 

All existing printouts from original storage which concern the categories identified 


in subsection Ila. 


Review Protocols 


Review of the items described in Attachment A and Attachment B shall be conducted 


professional responsibility requirements concerning the maintenance of attorney-client and other 


operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
THREE ACCOUNTS STORED 

AT PREMISES CONTROLLED BY 
MICROSOFT CORPORATION 


Case: 1:18-sc-02920 
Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 

Description: Search & Seizure Warrant 


` MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively lesa the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 USC. § 2705(b). In regard to the non- 
disclosure, the proposed Order would direct Microsoft Corporation (“Microsoft”), an electronic 
communication and/or remote computing services provider headquartered in Redmond, 
Washinplor not to notify any other person (except attorneys for Microsoft for the purpose of 
receiving legal advice) of the existence or content of the Warrant for a period of one year or until 
further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 

L. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 


the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 
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2. In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 USC. § 2711. Specifically, the Court is a 
“district court of the United States . . . that — has jurisdiction over the offense being investigated.” 
| 18 U.S.C. § 2711@)(A)G). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3: Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Microsoft provides an “electronic communications service,” as defined in 18 
U.S.C. § 25 10(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Microsoft may be 
compelled to supply communications and shes ae using a subpoena, court order, or search 
reer Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
. “subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(1)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4, The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such . 
notification. In relevant part, Section 2705(b) provides as follows:' 

(b) Preclusion of notice to subject of governmental access. — A governmental 

entity acting under section 2703 . .. may apply to a court for an order commanding 


a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court . 


' Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. . 
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deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 

(1) endangering the life or physical safety of an individual, 

(2) flight from prosecution; 

(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly Seige a trial. 


18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 
requisite showing about potential consequences of notification: 
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 


government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 


In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C, 2014), . 

5. . Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Microsoft not to notify any other person (except attorneys for Microsoft for the purpose 
of rocii legal advice) of the existence of the Subpoena for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. The Federal Bureau of Rectan (“FBI”) is investigating violations of 18 U.S.C. 
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a 
felony), 18 U.S.C. § 371 EEA 18 U.S.C. § 951 (acting as an unregistered foreign agent), 
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 


18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 ef seq. 
3 
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(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject 
Offenses”), in connection with efforts to compromise the networks of the Democratic National 
Convention (“DNC”), the Democratic Congressional Campaign Committee (“DCCC”), and the 
email accounts of U.S. persons involved in the 2016 presidential election, followed by the public 
release of stolen materials through various outlets. 

7. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Microsoft and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Microsoft for the purpose of receiving 
legal advice) for a period of one year or until futher order of the Court. Such an, order is 
appropriate because the Warrant relates to an ongoing criminal investigation, the scope and nature 
of which is neither public nor known to the targets of the investigation, and its disclosure may alert 
these targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant. 
and slated papers may also alert the targets to the scope of information known to the FBI. Once 
alerted to this information, potential targets would be immediately prompted to destroy or conceal 
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic R and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity ade investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 


longer needed, the Government will notify the Court and seek appropriate relief. 
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9. There is, therefore, reason to believe that notification of i the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tape with evidence, and intimidate witnesses. See 18 U.S.C. 
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a | 
compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Microsoft, the United States is aware that, absent a 
court order under Section 2705(b) commanding Microsoft not to notify anyone about a legal 
request, Microsoft may, upon receipt of a warrant seeking the contents of electronically stored wire 
or electronic communications for a certain account, notify the subscriber or customer of the 
existence of the warrant prior to producing the material sought. | 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Microsoft not to notify any other person of the existence or contents of the above-captioned 
warrant (except attorneys for Microsoft for the purpose of receiving legal advice) for a period of 
one year or until further order of the Court. 

Reasetiilly submitted, 


ROBERT S. MUELLER, HI 
Special Counsel 


Dated: 2/274 AB By: 


y 
The Spécial Counsel’s Office 


(202) 616-3812 
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AO 93 (Rev. 11/43) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 
In the Matter of the Search of ) Re te EE 
(Briefly describe the property to be searched ) Case: uae ie 02921 
or identify the person by name and address} ) peat i $ ee ryl A. 
Ssign. vate : 
INFORMATION ASSOCIATED WITH TWO ACCOUNTS _ ) Pgs : 
STORED AT PREMISES ) Description: Search & Seizure Warrant 
CONTROLLED BY GOOGLE ) i 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California 


(identify the person or describe the property to be searched and give its location): 


See Attachment A 


] find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before October 11, 2018 (not to exceed 14 days) 
if in the daytime 6:00 a.m. to 10:00 p.m. C at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell, Chief U.S. District Judge 


(United States Magistrate Judge) 


0 Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the teas who, or whose 
property, will be searched or seized (check the appropriate box) g 

1 for days (not to exceed 30) Ù until, the facts justifying, the later specific date bee 


Date and time issued: W247 2/9 ar J: aspin EtA VIRA 


Judge's signature 


eal 


City and state: Washington, DC l Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 
Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the Google accounts registered to the 
following email addresses, which are stored at premises owned, maintained, controlled, or . 


operated by Google, LLC (“Google”), a company headquartered in Mountain View, California: 


-l- 
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ATTACHMENT B 
I. Information to be disclosed by Google 
To the extent that the information described in Attachment A is within the possession, 
custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 
information that have been deleted but are still available to Google, or have been preserved 
pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 
information to the government for each account listed in Attachment A: 

a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 


the length of service, the IP address used to register the account, log-in IP addresses 


associated with session times and dates, account status, alternative email addresses: 


provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

c. The types of are iei 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 


-2- 
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k. 


All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; 

All subscriber “change history” associated with the account; 

All search history and web history associated with the account; 

All location and maps information associated with the account; 

All Google Analytics information associated with the account (including all 
properties and UA codes associated with the account, and, for each of these 
proprieties and UA codes, all usernames and email accounts associated with them); 
All Google Developers Console information associated with the account; 

All Minutemaid information associated with the omit 

All Android information associated with the account; 

All Google Docs associated with the account; 

All YouTube information associated with the account; 

All Google Hangouts information associated with the account; 

All Google Voice information associated with the account; 

All Web & App Activity associated with the account; 

All Google Drive information associated with the account; 

All Google+ information associated with the account; 

All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 


Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 


ot: 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI’), or 
International Mobile Equipment Identities (““IMEI”)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 

linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical Sues telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 

Il. Information to be Seized by the Government 

Any and all records that relate in any way to the accounts described in Attachment A 

which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and - 

abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 

U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 

access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 

§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 

conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from March 1, 2016 to the present, including: 
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All records, information, documents or tangible materials that relate in any way to 

communications regarding hacking, release of hacked material, communications 

with persons or entities associated with WikiLeaks, including but not limited to 

Julian Assange, or communications regarding disinformation, denial, dissembling 
) 


or other obfuscation about knowledge of, or access to, hacked material; 


All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, | B 


individual associated with the Trump Campaign, any witness in the investigation; 
Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 


the geographic and chronological context of account access, use, and events relating 


to the crimes under investigation and to the account owner; 


h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 
i. The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 

j. Credit card and other financial information, including but not limited to, bills and 
payment Se evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

1. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for fie benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

0. All existing printouts from original storage which concern the categories identified 


in subsection H.a. 
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HI. Review Protocols 

Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 


Ts 
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sep 27 W8 


Di Bankfuptcy 
Merk, US. District & Ban 
pare for the District of Columbia 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH TWO 
ACCOUNTS STORED AT PREMISES 
CONTROLLED BY GOOGLE 


Case: 1:18-sc~02924 

Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 

Description: Search & Seizure Warrant 


ORDER 
The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Google, an electronic communication and/or remote computing services provider 
headquartered in Mountain View, California, not to disclose the existence or contents of the 
Warrant pursuant to 18 U.S.C. § 2705(b). 
| The Court finds that the United States has established that a compelling EARE 
interest exists to justify the requested sealing, and that there is reason to believe that notification | 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy df tamper with evidence, and intimidate 
witnesses, See 18 U.S.C. § 2705(b)(2)-(5). 
| IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related — 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and. 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 
attorneys for Google for the purpose of receiving legal advice) for a period of one year or until 


. further order of the Court. 


A, Hus 


THE HONORABLE BERYL A. HOWELL 
CHIEF UNITED STATES DISTRICT JUDGE 


ah nwd 


Date 
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UNITED STATES DISTRICT COURT ie a ie 


for the DERIT are ; 
District of Columbia SEP 2 7 M 
Glerk, U.S. District & fankrupicy 
In the Matter of the Search of ) Corres fy the District of Golumbla 
(Briefly describe the property to be searched ) Case: 1 :18-sc-02921 ; 
or identify the person by name and address) ) Ass igne dTo:H | 
INFORMATION ASSOCIATED WITH ) : Howell, Beryl A. 
TWO ACCOUNTS STORED AT PREMISES J Assign. Date : 9/27/2018 
CONTROLLED BY GOOGLE $ Description: Search & Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 


located in the 
person or describe the property to be seized): 
See Attachment B 


Northern District of . California , there is now concealed (identify the 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
Sf evidence of a crime; 
Mf contraband, fruits of crime, or other items illegally possessed; 
ri property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
52 U.S.C. § 30121 Foreign Contribution Ban 
18 U.S.C. §§ 1001, 1030, 371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 
The application is based on these facts: 
See attached Affidavit. 


iw Continued on the attached sheet. 
O Delayed notice of days (give exact ending date if more than 30 days: ~. ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Applicant’s signature 


Patrick J. Myers, Special Agent, FBI 


Kyle R. Freeny (ASC) 


Printed name and title 


Sworn to before me and signed in my presence. 


Date: I2 MEUA a ttt. LA 


~ dudge’s signature 


Hon. Beryl A. Howell, Chief U.S. District Judge 


City and state: Washington, D.C. 


Printed name and title 
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eno oF 
IN THE UNITED STATES DISTRICT COURT SEP 272 


ED 
Me 


FOR THE DISTRICT OF COLUMBIA Perk, U.S. Dioirlot & Bankruptcy 
Courts for the District of Golumbla 


IN THE MATTER OF THE SEARCH OF 

l : 1:18=sc- 1 
INFORMATION ASSOCIATED WITH eerie ie P 
TWO ACCOUNTS STORED AT PREMISES accion Date : 9/27/2018 


CONTROLLED BY GOOGLE Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF . 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 
L. I make this affidavit in support of an application for a search warrant for 


information associated with the Google accounts registered to and 


the “Target Accounts 1 & 2”), stored at premises owned, maintained, 


controlled or operated by Google, LLC (“Google”), a company headquartered in Mountain View, 


California. As set forth below, the Target Accounts 


Upon receipt of the information 


described in Attachment A, government-authorized persons will review that information to locate 
_ the items described in Attachment B. 

2. | I am a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have aon a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 
security investigations relating to foreign intelligence and cybersecurity. 

3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 


fe 
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intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4, | Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 Cina 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
ie fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, sonaban fruits, 
and/or EEEE E of the Subject Offenses, further described in Attachment B. 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 

competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703{a), OXIA), & 
(ce) (A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 
$ 2711)(A)(G). The offense conduct included activities in Washington, D.C., as detailed below. 
PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 
6. Roger STONE is a self-employed political strategist/consultant and has been 


actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 


oe 
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Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii. Jerome CORSI 
Ta Jerome CORSLis a political aait who, according to publicly available 

information, served as the “Washington Bureau Chief for Inforwars.com.” According to 
publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
‘books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 


-3- 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
‘Election i 


9. On January 6, 2017, the USIC released a declassified version ofan intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the . 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and-the Russian l 

Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government Sioe during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
aiy sith overt efforts by Russian Government agencies, state-funded media, third-party 
intermediaries, and paid social media users or ‘trolls.’” 

11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
services conducted cyber operations aoa targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “fi]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 


- and maintained that access until at least June 2016.” The USIC attributed these cyber activities 


to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 


-4- 
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in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13.  Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. far example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
ios accounts. 

16. Onor about September 4, 2016, individuals associated with the GRU stole the 
emails from a former White House advisor who was then advising the Clinton Campaign. These 
emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 


elections in numerous Florida counties. 


5- 
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18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
_ presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
hissed government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

IA On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 
and stated: “Here’s Guccifer 2.0°s website. Have a look and you’ ll see he explains who he is and 
why he did the hack of the DNC.” The article also stated “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 


22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
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Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE an asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 

- has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his ER pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guecifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” shee Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guceifer also sent a private message to @RogerJStonedr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 

26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 


27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 


Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 20 of 57 


soon the [sic] A time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, 1 think J an 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Cheryl Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the aison as to what exactly what was erased 
on that email server.” | 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 
to tweet: “Payload coming. #Lockthemup.” | 

31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 


32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
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“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 
33.  WikiLeaks continued to release John Podesta’s hacked emails through Election 

Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONIS’s August 21, 

-2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to ~ 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE] .” Commenting to the NBC News, STONE indicated that he had never met or spoken 

_ with Anane saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. Pm not implying I have any 
influence with him or that I have Pee knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Chery! Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” | 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that we was any backchannel 
communication ee the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 
charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” . 
D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 


35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
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Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter ~ 
account @wikileaks.' The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and ini defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wilkileaks Eid by direct message: “We appreciate | 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” | 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you're lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” | 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 
now more free to communicate.” | 

39. i addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 
the founder of WikiLeaks. For example, on June 4, 2017, @Rogerl Sa directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get neon only that it is 


accurate and authentic. The New York Times printed the Pentagon Papers which were 


! On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStonelJr. 
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indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
aies dropped J don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” | 

40. On Saturday, June 10, 2017, @RogerJ: Stonelr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 
this forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with STONE, O Q Others Regarding 
Forthcoming Leaks : 


41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE’s | & O oo On October 17, 


2017, Chief Judge Howell issued a search warrant for one of STONE’ sf adresses, 


On or about December 19, 2017, Chief Judge Howell issued a search 
warrant for email account. On or about March 14, 2018, Chief Judge Howell 
issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 
search warrants indicated the following: 

42. On or about May 15, 2016, EE «i: CORSI: “Here is my flight 


schedule. Need to get something confirmed now . . . .” CORSI responded, “I copied Roger 


Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 


oe 
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appears to have forwarded the message to STONE at Pp E replied to 


CORSI that, “May meet Manafort -guarantce nothing.” 


43. Onor about May 18, 2016, CORSI emailed STONE at ae 


with the title, “Roger -- why don't you look this over before I send it a: believe that 


CORSI wrote, 


and I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized cs snc and 
was very cordial. He would look for this memo from you this afternoon.” 
44. On July 25, 2016, STONE, using o B an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[ajt Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” l 
45.  Onorabout July 31, 2016, STONE, aine emailed 
CORSI with the subject line, “Call me MON.” The body of the email read: Oo should see 
Assange[.] Ss should find Bernie [Sanders brother who called Bill a Rapist — turn him for 
Trump[.] = should find O G more proof of Bill getting kicked out.” 
On or about August 2, 2016 (approximately 19 days before STONE publicly 
tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 
D.. is friend in embassy plans 2 more dumps. One shortly after Pm 
back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 


campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 


EDA 
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be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not iui to start suggesting HRC old, memory bad, has stroke -- 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORS? s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. On or about August 5, 0 o an associate of STONE’s, emailed 
STONE at Oo A email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can[.] I dined with my new pal 


Julian Assange last night.” | ERR stated to investigators that, around the 


same time, STONE told him he had gone to London to meet assancr M also stated 


that in 2018, Oo Q STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told E.. was joking and 
had not actually met ASSANGE.? | . 

48, Through a saek oF STONE’s iCloud account, the FBI has uncovered evidence 
suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email to i os to have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
- goin LA?” STONE eonda, “It’s this afternoon[.]” The following day, the associate asked, 


“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 


13. 
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call later — heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 a had geo-location 
information indicating that it was taken in Los Angeles. 

49, On or about August 15, 2016, CORSI emailed STONE at 
O B me a call today if you can. Despite MSM drumroll that HRC is 

already elected, it’s not over yet. More to come than anyone feats. Won’t really get started - 
until after Labor Day. I’m in NYC this week. Jerry.” 

50. | On or about August 31, 2016, CORSI emailed STONE at 

0O B you get the PODESTA writeup.” STONE replied “[y]es.” 

51. ` On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Pomii in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers Bak Podesta hired by 
S[b] erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. Onor about September 6, 2016, CORSI emailed STONE at 

O= E8 Is NY Post going to use the Pedesta [sic] stuff?” 

53; On or about September 24, 2016 GS CORSI, “I will have much 
more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again ody” wrote back, “Awaiting secret file. Penoy Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep is posted 
about file[.]” In a subsequent meeting with investigators MM in dicated this 


conversation concerned possible derogatory information he was trying to obtain from Turkey. 
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. 54. On or about October 3, 2016, an associate of STONE emailed STONE at 

Ooo g R “Assange — what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. Pd say that’s 
important.” 

55. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 

57. That same day, BANNON emailed STONE a, D was 
that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 


cut deal w/ clintons???” STONE replied, “Don't think so BUT his iovye D is a big 


democrat.” 
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58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018; he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. 


59. According to a publicly available news article,’ at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

60. According to phone records ae: approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. l 

61. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted eet twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 

63. . Atapproximately 2:18PM, CORSI called STONE and the two spoke for 


approximately twenty minutes. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 1474714-8ce5-11¢6-875e-2c1 bfe943b66_story.html 
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64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 
65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
‘hacked from Jobn Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE — expect 


that much of next dump focus, setting stage for Foundation debacle.” 


66. At approximately 6:27PM, aaa an author who has written about the 


Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 


newly-released Podesta emails. Approximately ten minutes later, STONE, using 


o= R fecal message to CORSI without comment. STONE 


does not appear to. have forwarded the email to any other individual. 


G. STONE Asks CORSI for “SOMETHING” to Post About f Podesta After STONE Is © | 
Accused of Advance Knowledge of the Leak 


67. Onor about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know dey will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 


numbers.” 


68. On or about Wednesday, October i2, 2016, at approximately 8:17AM, STONE, 


2 Z Corsi asking him to “send me your best podesta links.” 


STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 


CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
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Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69, On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at both as «i the subject 
line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 


CORSI back via DO coon, “Got them and used them.” 


71. On or about Thursday, October 13, 2016, CORSI emailed STONE at 
ne! “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since Į am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “TH give you one more — NOBODY YET HAS THIS{:] It looks to me 
ike fA maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank{.] The Russians launched a criminal investigation[.] [web link] Once 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how suid money ie laundered, or where it ended up. 


Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank{.] I’m working on. that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72: On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email iii with the subject, “ROGER STONE article 
KUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did T a controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, launder through — 
Metcombank, a Russian regional bank owned 99.978 percent Evie the money 
E EN via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is eae by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a nasie to STONE at his iCloud 
account, “Pm in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going E new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pmI[.]”? STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 
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75. On or about October 17, 2016, CORSI emailed STONE at 
ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead eas files that include Hillary. 
It?s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, sane he’s dropped what he has. If HRC ins; Assange can 
kiss his life away. jaers gambit Assange has to s out. He’s called Podesta’s bluff and 
raised him the election.” Based on review of the original email that CORSI forwarded, the 
“trusted source” was a self-identified retired librarian who gathers information from public chat 
rooms. 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pls call. Important.” 

Thae On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 


“Congratulations, Roger. He could not have done it without you.” 
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80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 

` the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. .. . 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 
true. 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 

encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange, 

you were only referring to a single fact that you had confirmed with the intermediary — 

MR. STONE: That — 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. 

90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
_ Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel? referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. ... [Mly tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE?’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “Stonewall it. Plead the fifth. Anything to 
save the plan’........ Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 


the house committee lawyer told my lawyer that I will be getting a subpoenaf.] STONE wrote 
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back, “That was the point at which your lawyers should have told them you ula assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him ts perfectly legal and all you ever told me was 
he had the goods fojn Hillary and eile publish them — which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].””» CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
| interview him or meet him until August 26th[.] That was my first EEE with his 

secretary in patie August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE ene via text message more than a dozen 

“times. | 
96. On November 29, 2017, STONE publicly stated that CREDICO was his 


“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which bie 
pending sablieation: ... Credico never said he knew or had any information as to source or 
content of the material.” | 
97. On or about December L 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.]* You could have just told him the truth that you didn’t have a 
back Channel they now know that I = not in London until September of this year[.] You had 
no back-channel and you could have just told the truth . .. You want me to cover you for perjury 
now].]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you're arcbably clearf.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back . . . and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE plied “Tf 
“you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for _ 


perjury if you’re stupid enough to testify[.]” 


4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the 
FBI. 
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98. | STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99. Onor about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs...+17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee . . . But you'll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
fot a ba[ck] Channel and I have all those emails from September of 2016 to prove it[,]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 


reporters copies of email messages he had received from STONE in the prior few days that 
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stated, “You are a rat. You area stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you ae bringing up my dog, you’re crossing the line[.]° 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.° In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer... It was sent in response to that. We talked about it too. 
He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 


have prostate cancer and did not have any such discussion with STONE. 


K. The Target Accounts 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 


threatened-dog-135911370. html 
6 https://Awww.motherjones.com/politics/201 8/05/roger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERNING GOOGLE 


115. In my training and ek I have learned that Google provides a variety of on- 
line services, including electronic mail (“email”) access, to the public. Google allows Seen 
to obtain email accounts at the domain name gmail.com, like the Target Accounts. Subscribers 
obtain an account by registering with Google. During the registration process, Google asks 
subscribers to provide basic personal information. Therefore, the computers of Google are likely 
o contain stored electronic communications (including retrieved and unretrieved email) for 
Google Mail subscribers and information concerning subscribers and their use of Google Mail 


services, such as account access information, email transaction information, and account 
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application information. In my training and experience, such information may constitute evidence 
of the crimes under investigation because the information can be used to identify the account’s 
user or users. | 

116. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 
identifiers, alternative email ren and, for paying subscribers, means and source of payment 
(including ay credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to - 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

117. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(ie., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging info the account via fig provider’s website), and athe log files that reflect usage of the 
account. In addition, email providers often have records of the IP address used to register the 
account and the IP addresses associated with particular logins to the account. Because every device 
that connects to the Internet must use an IP address, IP address information can help to identify 


which computers or other devices were used to access the email account. 
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118. In my training and experience, in some cases, email account users will 
communicate inui with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may. constitute 
S of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

119. This application seeks a warrant to search all responsive records and information 
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where 
Google has chosen to store such information. The government intends to require the disclosure 
pursuant to the requested warrant of the contents of wire or electronic communications and any 
records or other information pertaining to the customers or subscribers if such communication, 
record, or other information is within Google’s possession, custody, or control, regardless of 
whether such communication, record, or other information is stored, held, or maintained outside 
the United States. 

120. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled. 
the account. This “user attribution” evidence is analo gous to the search for “indicia of occupancy” 


while executing a search warrant at a residence. For example, email communications, contacts 


-33- 


Case 1:19-mc-00029-CRC Document 29-28 Filed 04/28/20 Page 46 of 57 


lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time (e. g., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g., communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 
FILTER REVIEW PROCEDURES 
121. Review of the items described in Attachment A and Attachment B will be ` 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 
CONCLUSION 


122. Based on the forgoing, I request that the Court issue the proposed search warrant. 
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123. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 

required for the service or execution of this warrant. 
REQUEST FOR SEALING 

124. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These . 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 

Respectfully submitted, 


atrick J. Myers 
' Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this 2 Pay of September, 2018. 


r 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 

Property to be Searched 
This warrant applies to information associated with the Google accounts registered to the 
following Sail addresses, which are stored at premises owned, maintained, controlled, or © 


operated by Google, LLC (“Google”), a company headquartered in Mountain View, California: 
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h. 


All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 
actions taken; | 

All subscriber “change history” associated with the account; 

All search history and web history associated with the account; 

All location and maps information associated with the account; 

All Google Analytics information associated with the account (including all 
properties and UA codes associated with the account, and, for each of these 
proprieties and UA codes, all usernames and email accounts associated with them); 
All Google Developers Console information associated with the account; 

All Minutemaid information associated with the atoi 

AH Android information associated with the account; | 

All Google Docs associated with the account; 

All YouTube information associated with the account; 

All Google Hangouts information associated with the account; 

All Goo gle Voie information associated with the account; 


All Web & App Activity associated with the account; 


All Google Drive information associated with the account; 


All Google+ information associated with the account; 

All device information associated with the account, including all instrument or 
telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 


Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 


a 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, cine but not limited 0 
Julian Assange, or communications regarding disinformation, denial, dissembling 
, 


or other obfuscation about knowledge of, or access to, hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, ë i 


individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
ienei expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any- and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to anie activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 
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k. 


Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

Credit card and other financial information, including but not limited to, bills and 
payment eco evidencing ownership of the subject account; 

All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering Sbintintoation: and 

The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 


foreign government, foreign officials, foreign entities, foreign persons, or foreign 


principals. 


Passwords and encryption keys, and other access information that may be necessary 


to access the account and other associated accounts; 
All existing printouts from original storage which concern the categories identified 


in subsection H.a, 
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UI. Review Protocols 

. Keiew of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
`- professional responsibility requirements concerning the T of attorney-client and other 
operative privileges. When appropriate, the Proper: shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc—-02921 

INFORMATION ASSOCIATED WITH TWO Assigned To : Howell, Beryl A. 
ACCOUNTS STORED AT PREMISES Assign. Date : 9/27/2018 
CONTROLLED BY GOOGLE Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support ree (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. §2705(b). In regard to the non- 
disclosure, the proposed Order would direct Google, an electronic communication and/or remote 
computing services provider headquartered in Mowi View, California, not to notify any other 
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or 
content of the Warrant for a period of one year or until further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 

1. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Ge. 1980) (citing | 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2. In addition, this Court has jurisdiction to issue the requested order because it is “a | 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 


“district court of the United States . . . that — has jurisdiction over the offense being investigated.” 
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18 U.S.C. § 2711(3)(A)@). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Google provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711@). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Google may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(1)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 
notification. In relevant part, Section 2705(b) provides as follows:! 

(b) Preclusion of notice to subject of governmental access. — A governmental 

entity acting under section 2703 . . . may apply to a court for an order commanding 

a provider of electronic communications service or remote computing service to 

whom a warrant, subpoena, or court order is directed, for such period as the court 

deems appropriate, not to notify any other person of the existence of the warrant, 

subpoena, or court order. The court shall enter such an order if it determines that 

there is reason to believe that notification of the existence of the warrant, subpoena, 

or court order will result in— 


(1) endangering the life or physical safety of an individual; 
(2) flight from prosecution; 


! Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
_ §2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(3) destruction of or tampering with evidence; 
(4) intimidation of potential witnesses; or 
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 
requisite showing about potential consequences ot notitication: 
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 


government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 


In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. $ 2705() for Grand Jury 
Subpoena #GJ201403 1422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

$: Accordingly, this motion: to seal sets forth facts showing reasonable grounds to 
command Google not to notify any other person (except attorneys for Google for the purpose of 
receiving legal advice) of the existence of the Sipon for a period of one year or until further 
order of the Court. 

FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S.C. 
5 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18 U.S.C. § 4 (misprision ofa - 
felony); 18 U.S.C. § 371 (conspiracy); 18 U.S.C. § 1030 (unauthorized access of a protected 
computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject Offenses”), in 
connection with efforts to compromise the networks of the Democratic National Convention 
(“DNC”), the Democratic Congressional Campaign Committee (“DCCC”), and the email accounts 


of U.S. persons, followed by the public release of stolen materials through various outlets. 
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ds In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Google and its employees be directed not to notify any other person of the 
| existence or content of the Warrant (except stomeys for Google for the purpose of receiving legal 
advice) for a period of one year or until further order of the Court. Such an order is appropriate 
because the Warrant relates to an ongoing criminal investigation, the scope and nature of which is 
neither public nor known to the targets of the A and its dilokne may alert these 
targets to the nature, scope, and focus of the ongoing investiaation: Disclosure of the Warrant and 
aid papers may also alert the targets to the scope of information known to the FBI. Once alerted 
to this information, potential targets would be immediately prompted to destroy or conceal. 
| incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic communication and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal genie. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be sage the Government anticipates that this 
confidential investigation will continue for the next year or longer. Hoeven should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 

9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 


§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
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compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Google, the United States is aware that, absent a court 
order under Section 2705(b) commanding Google not to notify anyone about a legal request, 
Google may, upon receipt of a warrant seeking the contents of electronically stored wire or 
electronic communications for a certain account, notify the subscriber or customer of the existence 
of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Google not to notify any other person of the existence or conterits of the above-captioned warrant 
(except attorneys for Google for the purpose of receiving legal advice) for a period of-one year or 
until further order of the Court. 

| Respectfully submitted, 


ROBERT S. MUELLER, III 
Special Counsel 


Dated: 2/Z-E2 By: ae 


The Spécial Counsel’s Office 
(202) 616-3812 
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«and Seizure Warrant 


hi 
y UNITED STATES DISTRICT COURT 
: for the 
District of Columbia 
| 
Ps In the Matter of the Search of ie gas och | 
ra (Briefly describe the property to be searched Case: 1:18-se ae B IA l 
a or identify the person by name and address) Assigned To : User i : 
INFORMATION ASSOCIATED WITH ONE account Assign. Date : 9 Seizure Warrant | 
STORED AT PREMISES Description: Search & Seizu | 
CONTROLLED BY APPLE 3 - i l 
SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern District of California 


(identify the person or describe ihe property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to execute this warrant on or before October 11, 2018 (not to exceed 14 days) 
M in the daytime 6:00 a.m. to 10:00 p.m. (Jat any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to ___ Hon. Beryl A. Howell, Chief U.S. District Judge 7 
(United States Magistrate Judge) 


C Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
pr operty, will be searched or seized (check the appropriate box) 

-O for____days (not to exceed 30) O until, the facts justifying, the later ee date of 


Date and time issued: Wad: D/F al A ILI Aart Laer 


Judge's signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


Pr inted name and title 


TTL TT TTT TTI 


PSA ETS RANE 


SSE ATER ATR AT TIT TOTO 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of; 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


eculing officer's signatur, 
Executing ‘s signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following accounts, which are 
stored at premises owned, fun controlled, or operated by Apple, Inc. (“Apple”), acompany 


headquartered in Cupertino, California: 
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ATTACHMENT B 

I. Information to be disclosed by Apple 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Apple, Inc. (hereinafter “the Provider”), regardless of whether such 
information is stored, held or maintained inside or outside of the United States, and including 
any emails, records, files, logs, or information that have been deleted but are still available to the 
Provider, or has been preserved. pursuant to a request made under 18 U.S.C. § 2703(), the 
Provider is required to disclose the following information to the government for each account or 


identifier listed in Attachment A: 


a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each. 
email was sent, and the size and length of each email; 


b. All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); ~ 


c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All records pertaining to communications between the Provider and any person 


regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative e-mail addresses provided 
during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 
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All search history or web history; 
All records indicating the services available to subscribers of the accounts; 


All usernames associated with or sharing a login IP address or browser cookie with 
the accounts; 


All cookies, including third-party cookies, associated with the user; 


All records that are associated with the machine cookies associated with the user; 
and 


All telephone or instrument numbers associated with the Account (including MAC 
addresses, Electronic Serial Numbers (“ESN”), Mobile Electroriic Identity 
Numbers (“MEIN”), Mobile Equipment Identifier ( MEID”), Mobile Identification 
Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEI”). 


Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2016, to December 31, 2017, including: 


a. 


All records, information, documents or tangible materials that relate in any way to 


_ communications regarding hacking, release of hacked material, communications 


with persons or entities associated with WikiLeaks, including but not limited to 


3- 
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Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi iii. Julian 


Ortel, or any individual associated with the Trump Campaign; > 

C. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign . 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 


investigation; 
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k. 


The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

All images, messages and communications regarding wiping software, encryption’ 
or other methods to avoid detection by law enforcement; 

The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 


All existing printouts from original storage which concern the categories identified 


in subsection I.a. 


HI. Review Protocols 


Review of-the items described in Attachment A and Attachment B shall be conducted 


pursuant to established procedures designed to collect evidence in a manner consistent with 


professional responsibility requirements concerning the maintenance of attorney-client and other 
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operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 
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FILED 


IN THE UNITED STATES DISTRICT COURT SEP 27 2018 


FOR THE DISTRICT OF COLUMBIA Clerk, U.S, District & Bankruptcy 
Courts for the District of Columbia 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02922 

INFORMATION ASSOCIATED WITH ONE Assigned To : Howell, Beryl A 
ACCOUNT STORED AT PREMISES Assign. Date : 9/27/2018 . 
CONTROLLED BY APPLE, INC. Description: Search & Seizure Warrant 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Apple, Inc., an electronic communication and/or remote computing services 
provider headquartered in Cupertino, California, not to disclose the existence or contents of the 
Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, ‘nd intimidate 
witnesses. See 18 U.S.C, § 2705(b)(2)-(5). . 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 
materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C, § 2705(b), Apple and its 
employees shal] not disclose the existence or content of the Warrant to any other person (except 


attorneys for Apple for the purpose of receiving legal advice) for a period of one year or until 


o 
THE HONORABLE Af A. HOWELL 


CHIEF UNITED STATES DISTRICT JUDGE 


further order of the Court. 


qail 


Date 
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AO 106 (Rev, 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT FILED 
for the SEP 27 2018 


District of Columbia Clerk, U.S. District & Bankruptcy 
Courts for the District of Columbie 


Case: 1:18-sc-02922 

Assigned To : Howell, Beryl A. 

Assign. Date : 9/27/2018 

Description: Search & Seizure Warrant 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES CONTROLLED 
BY APPLE 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 

located in the Northern District of California , there is now concealed (identify the 
person or describe the property to be seized): 

See Attachment B 


The basis for the search under Fed. R. Crim, P. 41(c) is (check one or more): 
tf evidence of a crime; 
contraband, fruits of crime, or other items illegally possessed; 
í property designed for use, intended for use, or used in committing a crime; 


O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
52 U.S.C. § 30121 Foreign © Contribution Ban 
18 U.S.C. §§ 1001, 1030, 374 False Statements, Unauthorized Access of Protected Computer, Conspiracy 
See Affidavit for add'l 
The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: __ ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Reviewed by AUSA/SAUSA: Applicant's signature 


Kyle R. Freeny (ASC) T Patrick J. Myers, Special Agent, FBI 
Printed name and title 


Sworn to before me and signed in my presence. 


ow 127A EAA Mae EF 


Judge's signature 


City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 


UNER AE NEEE AE EEEE TE A EESE RES SEROREN: 
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FILED 


IN THE UNITED STATES DISTRICT COURT SEP 2 7 2018 

FOR THE DISTRICT OF COLUMBIA 
Clerk, U.S. District & Bankruptcy 
Courts for the District of Golumble 


IN THE MATTER OF THE SEARCH OF 
INFORMATION ASSOCIATED WITH 
ONE ACCOUNT STORED AT PREMISES 
CONTROLLED BY APPLE 


; Case: 1:18-sc-02922 
Assigned To : Howell, Beryl A. 
Assign. Date : 9/27/2018 
Description: Search & Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 


INTRODUCTION AND AGENT BACKGROUND 


l. 1 make this affidavit in support.of an application for a search warrant for 
information associated with the Apple account | --- Account”), dowi at 
premises owned, maintained, controlled or operated by Apple, Inc. (“Apple”), a company 
headquartered in Cupertino, California. As set forth below, the Target Account is believed to be 
used by an associate of STONE who was in communication with STONE on the day that 
WikiLeaks first released emails stolen from Clinton Campaign chair John Podesta and who appears 
to have met with STONE in October 2016 on the same day that STONE publicly claimed to have 
had dinner with his back-channel to WikiLeaks founder Julian Assange. Upon receipt of the 
information described in Attachment A, government-authorized persons will review that 
information to locate the items described in Attachment B. 


as Iam a Special Agent with the Federal Bureau of Investigation (“FBI”) assigned to 


FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent ` 


with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 


security investigations relating to foreign intelligence and cybersecurity. 


= 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show N that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Account contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to Saunt 
wire fraud), 18 U.S.C, §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. 


JURISDICTION 


5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), WANA) & 
(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court). . . that has jurisdiction over the offense being investigated.” 18 U.S.C, 


§ 2711(3)(A)(i).. The offense conduct included activities in Washington, D.C., as detailed below. 


A, 
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PROBABLE CAUSE 
A. Background on Relevant Individuals 
i, Roger STONE 
6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015, Although Stone had no official | 


relationship with the Campaign thereafter, STONE maintained his support for Trump and 


continued to make media appearances in support of the Campaign. As described further below, 


STONE also maintained contact with individuals employed by the Campaign, including then- 


campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii. Jerome CORSI 
7. Jerome CORSI is a political commentator who, according to publicly available 
information, served as the “Washington Bureau Chief for Inforwars.com.” According to 
publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 


for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 


books regarding Democratic presidential candidates. As described further below, CORSI was in | 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 


ice 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 
Election i 


9, On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 
“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 
assessed the following: 

[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 

US presidential election. Russia’s goals were to undermine public faith in the US 

democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 

electability and potential presidency. We further assess Putin and the Russian 

Government developed a clear preference for President-elect Trump. 

10. In its assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity —with overt efforts by Russian Government agencies, state-funded media, third-party 


intermediaries, and paid social media users or ‘trolls. 


11. | With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 
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services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US politica! parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures, By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13. Guecifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU sinfen to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 


emails from a former White House advisor who was then advising the Clinton Campaign. These 
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emails were later post on DC Leaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125),. 

C. STONE?’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19, On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “(t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker whe goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 


and stated: “Here’s Guccifer 2.0’s website. Have a look and you’ll see he explains who he is and 
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why he did the hack of the DNC.” The article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22. On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter, The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25. On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
` great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 


26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 


He 


tA ESRI EEEE: 


sree 
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resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. | 

27. On August 21, 2016, using @Roger]StoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” Ina C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 


[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 


form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian” 


Assange is a hero... [ think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Chery! Mills, the 
Clinton aides, believe they deleted. That and a lot more, These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a aao interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary ona weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. OnSunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London, On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 


to tweet: “Payload coming. #Lockthemup.” 
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31. OnFriday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Holfywood shoot in 
one Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 


“RELEASE: The Podesta Emails #HillaryClinton #Podesta #im WithHer” and containing a link 


to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 


33.  WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 


[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 


with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 


everything I know is through that channel of janine Pm not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Chery] Mills, the Clinton aides, 
thought were deleted, I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that hee was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since | never communicated with WikiLeaks, I guess I must be innocent of 


charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
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or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 
D. STONE’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35, On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks.' The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying, Your 
operation leaks like a sieve, You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are i 
now more free to communicate.” 


39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 


' On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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the founder of WikiLeaks. For dee. on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards..R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40, On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “J am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 


this forum as experience demonstrates it is monitored. Best regards R.” 


A and Others Regarding 


41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE s G o ooo On October 17, 


_ 2017, Chief Judge Howell issued a search warrant for one of STONE n 


a: or about December 19, 2017, Chief Judge Howell issued a search 


warrant sl email account. On or about March 14, 2018, Chief Judge Howell 


E. CORSI’s Communications with STONE, 
Forthcoming Leaks 


issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 


search warrants indicated the following: 


mip 
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42. On or about May 15, 2016 TE ies CORSI; “Here is my flight 


schedule. Need to get something confirmed now... .” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 


appears to have forwarded the message to STONE ie °° replied to . 


CORSI that, “May meet Manafort -guarantee nothing.” 


43. On or about May 18, 2016, CORSI emailed STONE 7 


with the title, “Roger -- why don't you look this over before I send it to pT believe that 


CORSI wrote, 


and I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 
was very cordial. He would look for this memo from you this afternoon.” 

44. On July 25, 2016, STONE, vin an email to 
CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 
[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails...they deal with 
Foundation, allegedly.” The text of this email from STONE to CORSI substantially mirrored the 
text of ah email that STONE received from O freelance blogger who had been 
conducting research into the Clintons during presidential campaign—on or about the same day. 


45.  Onor about July 31, 2016, STONE, using — ied 


CORSI with the subject line, “Call me MON.” The body of the email read: MI should see 


Assange[. | limes] should find Bernie [S]anders brother who called Bill a Rapist — turn him for 


Trump|.] HR find o more proof of Bill getting kicked out.” 


46. Onor about Angust 2, 2016 (approximately 19 days before STONE publicly 


tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 
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0O B is friend in embassy plans 2 more dumps, One shortly after m 


back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 
will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation . 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. On or about August 5, 2016, on nwt an associate of STONE’s, emailed 
STONE i! The email contained a link to a poll indicating that Clinton 


led Trump by 15 points, STONE responded “enjoy it while u can[.] I dined with my new pal 
Julian Assange last night.” IE subsequently stated to investigators that, around the 
same time, STONE told him he had gone to London to meet assaNcE SE 0 stated 
that in 2018, Endl told STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told a: was joking and 


had not actually met ASSANGE,? 


48, Through a search of STONE’s iCloud account, the FBI has uncovered evidence 
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suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 
in his email so to have “dined” with ASSANGE. For example, an associate of 
STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this afternoon[.]” The following day, the eae asked, 


“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 


call later — heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 

49. On or about August 15, 2016, CORSI emailed STONE at 


aes “Give me a call today if you can. Despite MSM drumroll that HRC is 


already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 


until after Labor Day, I’m in NYC this week. Jerry.” 
50. On or about August 31, 2016, CORSI emailed STONE at 
Did you get the PODESTA writeup.” STONE replied “[y]es.” 

51. Onor about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukeaing Yanukovych — Panam papers reveals Podesta hired by 
Sfb]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52. On or about September 6, 2016, CORSI emailed STONE at 
PR Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24, 2016, aa: CORSI, “I will have much 


more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 
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secure back channel ihrough Roger. I saw him again in NYC last Friday and spoke to him about 
it again today.” RE S back, “Awaiting secret file. Explosive... Hope you are well. 
Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigator DEG this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. - 

54, On or about October 3, 2016, an associate of STONE emailed STONE at 
o g asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The ET forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” | 

55. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On d about October 4, 2016, CORSI messaged STONE at his iCloud account: 


“Assange made a fool of himself. Has nothing or he would have released it, Total BS hype.” 
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57. That same day, BANNON emailed STONE “What was 
that this morning???” STONE replied, “Fear, Serious security concern. He thinks they are going 
to kill him and the London police are standing done [sic].”, BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don’t think so BUT his lawyer [J is a big 
democrat.” 

58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning, 


F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. 


59. According to a publicly available news article,* at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” . 

60. According to phone con i at approximately . 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53AM, STONE received a phone call from the Washington 


_ Post. The call lasted approximately twenty minutes, 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/3 1d74714-8ce5-1 1e6-875e-2cl bfe943b66_story.htm] 
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62. At approximately 1:42PM, STONE called CORSI and the two spoke for 
approximately seventeen minutes. 


63. At approximately 2:18PM, CORSI called STONE and the two spoke for 


approximately twenty minutes. 


64. At approximately 4:00PM, the Washington Post published a story regarding the 


Access Hollywood tape. 


65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 


hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE using aa “I expect | 


that much of next dump focus, setting stage for Foundation debacle.” 


66. At approximately Zn the person who originally suggested 
“getfting] to Assange,” and who, according to emails and phone records, regularly 
communicated with STONE—sent STONE an email titled, “WikiLeaks — The Podesta Emails,” 
with a link to the ER EE T Podesta emails. Approximately ten minutes later, STONE, 
usin i forwarded | E to CORSI without comment. 
STONE does not appear to have forwarded the email to any other individual. 


G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok, I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 


numbers.” 


Aye 
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68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 
Ba emailed Corsi asking him to “send me your best podesta links.” 
STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff 1 got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. ` Onor about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at bot i with the subject 
line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 
CORSI back via the Hotmail Account, “Got them and used them.” 

7i. On or about Thursday, October 13, 2016, CORSI emailed STONE at 

e ed “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION,” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, ‘TII give you one more — NOBODY YET HAS THIS{[:] It looks to me 
w o oo skimmed maybe billions off Skolkovo — Skolkovo kept their money with 


Metcombank[.] The Russians launched a criminal investigation{.] [web link] Once 
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had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much moncy he laundered, or where it ended up. 
Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72, On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email a with the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Panan and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money «ia a controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, launder through l 
Metcombank, a Russian regional bank owned 99.978 percent iii with the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at his iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 


basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 
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74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 


75. On or about October 17, 2016, CORSI emailed STONE at 


with the subject, “Fwd: 


S wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off].]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has, If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” Based on review of the original emai! that CORSI forwarded, the 
“trusted source” was a self-identified retired librarian who gathers information from public chat 
rooms. 

76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pls call. Important.” | 

77. On or about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 


it from Wikileaks, although Julian Assange and I share a common friend. I reported the story on 
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my website,” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above, 

78. . Onor about November 8, 2016, the United States presidential election took place, 

79, On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 
“Congratulations, Roger. He could not have done it without you.” 

80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 
account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 


SAE 
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I, STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today, The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts. ... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Pau! Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. . .. 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC, On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
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Assange to independently confirm this report, and he subsequently did, This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally | 
true. 


89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCL. 
Those excerpts include the following: 


Q: Have any of your employees, associates, or individuals acting on your behest or 
encouragement been in any type of contact with Julian Assange? 
MR. STONE: No, 


Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange, 

you were only referring to a single fact that you had confirmed with the intermediary — 

MR. STONE: That — 

Q: -- was the length and the breadth of what you were referring to? 

MR. STONE: That is correct, even though it was repeated to me on numerous separate 

occasions. 


90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails.... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 
ot. On or about November 19, 2017, Randy CREDICO (who, as described further 


below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
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lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’........Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 
the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — why wie u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them — which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 


what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 


about the DNC stuff[.] I just followed his tweets[.]” STONE responded, “U never said anything - 


about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th{,] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” | 

94, STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. On or about November 28, 2017, CREDICO tweeted a copy of a subpoena he 


received from HPSCI that was dated November 27, 2017. Toll records show that on November 
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27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times, 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 
“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,’ . .. Credico never said he knew or had any information as to source or 
content of the material.” | 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FB] today what a headache[.]* You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
‘no back-channel and you could have just told the truth ... You want me to cover you for perjury 
now|.]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for Sth 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back ... and amend your testimony and tel! them the truth.” CREDICO | 


repeated; “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 


4 Contrary to his statement, CREDICO had not at the time provided any forensic evidence to the 
FBI. 
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you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 
perjury if you’re stupid enough to testify[.]” | 

98. STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 


never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 


99. On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about ` 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon{.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs ...+ 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102, CREDICO and STONE continued to message each other, and on or about January 


25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee ... But you’l] get 
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off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from PEE R of 2016 to prove itf.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 
reporters copies of email messages he had received from STONE in the prior few days that 
stated, “You are a rat. You area stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” mobi message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you start bringing up my dog, you’re crossing the line[.]” 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.® In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 
He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 
have prostate cancer and did not have any such discussion with STONE. 


K. STONE’s Communications wit 


105. As noted above, in late July GG emailed STONE to “get to Assange,” 
which appears to have precipitated STONE’s email to CORSI with the same instruction. 


106. On or about August 17, 0 o sent an email to STONE’s Gmail account 


with the subject line, “Introduction.” The email was also sent to the work account SC 


> https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 
threatened-dog-135911370.html 
é https://www.motherjones.com/politics/201 8/05/roger-stone-to-associate-prepare-to-die/ 
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listed both ro: o telephone numbers, and he advised them, “You should find 


time to chat.” 

107. Toll records for STONE’s cellphone show that between August 18, 2016 and 
November 3, 201 EE +- in contact with STONE approximately 60 times. This 
included several calls on October 7, 2016, the day that WikiLeaks began releasing Podesta’s 
emails, On that | called STONE at approximately 12:33PM, within an hour of 
STONE ’s call with the Washington Post, which was about to publish information about the 
“Access Hollywood” tape. The call lasted approximately seven minutes. S appears to 
be the first person, other than journalists, to talk to STONE after STONE ’s call with the 
Washington Pos called STONE a second time at approximately 2:38PM on the same 
day. That call lasted approximately one minute. STONE also had a missed FaceTime call from 

mani at approximately 3:32PM the same day. WikiLeaks released the first tranche of stolen 
Podesta emails approximately one hour later. 

108. As noted above told investigators that in January 2017, CORSI told 
him that he (CORSI) and STONE were involved in and were aware of the timing and content of 
the WikiLeaks releases in advance, including the fact that the emails belonged to John Podesta, 
and CORSI implied, in sum and substance, that STONE was involved in the release of the 
Podesta emails by WikiLeaks. | 

109. According to open source information, on or about October 12, 2016, five days 
after the first release of stolen Podesta emails, STONE told a local news outlet in Florida, “I do 


have a back-channel communication with Assange, because we have a good mutual friend. That 
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friend travels back and forth from the United States to London and we talk. I had dinner with 
him last Monday.”? The Monday prior to the date of STONE’s statement was October 10, 2016. 
110, In the early hours of October 10, 2016, at approximately 3:26AM il 
texted STONE: Cf If you are still in NY we MUST meet tomorrow. Major major 
stuff.” At approximately 8:26AM the same day (but, effectively, the next morning, given the 
hour , if text), STONE replied, “Ok — can we meet UES?” UES appears to be a 
reference to the Upper East Side of New York City, where STONE maintained a residence. 
P| texted STONE at approximately 9:02AM, “Sure, Lunch? Coffee? Time?” and again at 
10:55AM, “What time works.” Investigators have not located a response from STONE, although 
oh called STONE at approximately 4:45PM, with a call duration of approximately 4 
seconds. 
11i. Cell-site location data for STONE shows that he was in the Upper East Side on 
the evening of October 10, 2016, when he claimed to have met with his contact to Assange. 
Financial records for STON: ie show a 
transaction on October 10, 2016, at a pizza parlor located in the Upper East Side, in the amount 
of approximately $20. 
112. Search warrant returns show that after WikiLeaks began to release Podesta’s 
emails in October 201 a | Gad STONE several times from the douni 
(“Target Account”) with links to WikiLeaks’ website and discussion about the 


s Podesta emails that WikiLeaks had released.. For example, on or about 


October 25,2016, ae sent an email from the Target Account to strone S account 


7 https://miami.cbslocal.com/2016/10/12/trump-ally-roger-stone-admits-back-channel-tie-to- 
wikileaks/ 
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with a link to the portion of WikiLeaks’ website containing Podesta emails, with the comment, 
“Cheryl Mills & John Podesta panic to cover Obama’s lies on Hillary emails.” 

113. Search warrant returns for cors i: account show 7 was in 
communication with CORSI at least in 2017. During an email exchange in June 2017 that 
appears to relate to financial policy-makers, CORSI iim that he was “concerned about 
Mueller,” following up shortly thereafter to clarify that had “meant Mnuchen,” the Secretary of 
Treasury. CORSI added, “Guess I have Special Counsel on mind these days.” 

114. For the foregoing reasons, there is probable cause to believe that the Target 
Account contains evidence, contraband, fruits, and/or instrumentalities of the Subject Offenses. 

BACKGROUND CONCERNING APPLE 

115. In my training and experience, I have learned that Apple provides a variety of on- 
line services, including electronic mail (“email”) access, to the public. Apple allows subscribers 
to obtain email accounts at the domain name me.com, like the Target Account. Subscribers obtain 
an account by registering with Apple. During the registration process, Apple asks subscribers to 
provide basic personal information. Therefore, the computers of Apple are likely to contain stored 
electronic communications (including ETR and unretrieved email for Apple subscribers and 
information concerning subscribers and their use of Apple services, such as account access 
information, email transaction information, and account application information. In my training 
and experience, such information iid constitute evidence of the crimes under investigation 
because the information can be used to identify the account’s user or users. 

116, K my training and experience, email providers generally ask their salies to 
provide certain personal identifying information when registering for an email account. Such 


information can include the subscriber’s full name, physical address, telephone numbers and other 
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identifiers, alternative email addresses, and, for paying subscribers, means and source of payishi 
(including any credit or bank account number). In my training and experience, such information. 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

117. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can | 
include the date on which the account was created, the length of service, records of log-in 
(i.e., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging into the account via the provider's website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the Internet Protocol address 
(“IP address”) used to register the account and the IP addresses associated with particular logins 
to the account. Because every device that connects to the Internet must use an IP address, 
IP address information can help to identify which computers or other devices were used to access 
the email account. 

118. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 


result of the communications. In my training and experience, such information may constitute 
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evidence of the crimes under investigation because the information can be used to identify the 
account’s user or users. 

119. This application seeks a warrant to search all responsive records and information 
under the control of Apple, a provider subject to the jurisdiction of this court, regardless of where 
Apple has chosen to sie such information. The government intends to require the disclosure 
pursuant to the requested warrant of the contents of wire or electronic communications and any 
records or other information pertaining to the customers or subscribers if such communication, 
record, or other information is within Apple’s possession, custody, or control, regardless of 
whether such communication, record, or other information is stored, held, or maintained outside 
the United States. 

120. AS explained herein, information stored in connection with an email account may 
provoi crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent om further suspicion, In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol ([P) addresses from which 
users access the email account, along with the time and date of that access. By determining the 


physical location associated with the logged IP addresses, investigators can understand the 
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chronological and geographic context of the email account access and use relating to the crime 
under investigation. This geographic and timeline information may tend to either inculpate or 
exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time (e. g., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g., EE relating to the crime), or consciousness of guilt 
EA deleting communications in af effort to conceal them from law enforcement), 
FILTER REVIEW PROCEDURES 

121. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges, The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 
122. Based on the forgoing, I request that the Court issue the proposed search warrant. 
123. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 


required for the service or execution of this warrant. 
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REQUEST FOR SEALING 


124. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


atrick J. Myers 


Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this Z Pn of September, 2018. 


KAk fed 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the following accounts, which are 
stored at premises owned, maintained, controlled, or operated by Apple, Inc. (“Apple”), a company 


headquartered in Cupertino, California: 
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ATTACHMENT B 

L Information to be disclosed by Apple 

To the extent that the information described in Attachment A is within the possession, 
custody, or control of the Apple, Inc, (hereinafter “the Provider”), regardless of whether such 
information is stored, held or maintained inside or outside of the United States, and including 
any emails, records, files, logs, or information that have been deleted but are still available to the 
Provider, or has been preserved pursuant to a request made under 18 U.S.C, § 2703(f), the 
Provider is required to disclose the following information to the government for each account or 


identifier listed in Attachment A: 


a. The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 


b. Al records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 


c. The types of service utilized; 

d. All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 
and files; 

e. All records pertaining to communications between the Provider and any person 


regarding the account, including contacts with support services and records of 
actions taken; and other identifiers, records of session times and durations, the date 
on which the account was created, the length of service, the types of service utilized, 
the IP address used to register the account, log-in IP addresses associated with 
session times and dates, account status, alternative e-mail addresses provided 
during registration, all other user names associated with the account, all account 
names associated with the subscriber, methods of connecting; 
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H. 


All search history or web history; 
All records indicating the services available to subscribers of the accounts; 


All usernames associated with or sharing a login IP address or browser cookie with 
the accounts; 


All cookies, including third-party cookies, associated with the user; 


All records that are associated with the machine cookies associated with the user; 
and 


All telephone or instrument numbers associated with the Account (including MAC 
addresses, Electronic Serial Numbers (“ESN”), Mobile Electronic Identity 
Numbers (“MEIN”), Mobile Equipment Identifier (“MEID”), Mobile Identification 
Numbers (“MIN”), Subscriber Identity Modules (“SIM”), Mobile Subscriber 
Integrated Services Digital Network Number (“MSISDN”), International Mobile 
Subscriber Identifiers (“IMSI”), or International Mobile Equipment Identities 
(“IMEI”). 


Information to be Seized by the Government 


Any and all records that relate in any way to the accounts described in Attachment A 


which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 


abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 


U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 


access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 


§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 


conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from June 1, 2016, to December 31, 2017, including: 


All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 


with persons or entities associated with WikiLeaks, including but not limited to 
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Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome Corsi, a Julian 


al or any individual associated with the-Trump Campaign; 

Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 
Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

All images, messages, communications, calendar entries, search terms, “address 
book” entries and Sones including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 
foreign principals; 

Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological detest of account access, use, and events relating 
to the crimes under investigation and to the account owner; 

Evidence indicating the account user’s state of mind as it relates to the crimes under 


investigation; 
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Ii. 


The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s}—who made any expenditure, independent 
E E or disbursement for an electioneering communication; and 

The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of ay 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

Passwords and encryption keys, and other access information that may be necessary 


to access the account and other associated accounts; 


' All existing printouts from original storage which concern the categories identified 


in subsection II.a. 


Review Protocols 


Review of the items described in Attachment A and Attachment B shall be conducted 


pursuant to established procedures designed to collect evidence in a manner consistent with 


professional responsibility requirements concerning the maintenance of attorney-client and other 
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operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 


-6- 


Case 1:19-mc-00029-CRC Document 29-29 Filed 04/28/20 Page 53 of 57 


IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02922 
INFORMATION ASSOCIATED WITH ONE Assigned To : Howell, Beryl A 
ACCOUNT STORED AT PREMISES Assign. Date : 9/27/2018 


CONTROLLED BY APPLE Description: Search & Seizure Warrant 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b) 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C, § 2705(b). In regard to the non- 
disclosure, the proposed Order would direct Apple, os (“Apple”), an electronic communication 
and/or remote computing services provider headquartered in Cupertino, California, not to notify 
any other person (except attorneys for Apple for the purpose of receiving legal advice) of the 
existence or content of the Warrant for a period of one year or unti! further order of the Court. 

JURISDICTION AND LEGAL BACKGROUND 
1. The Court has the inherent power to seal court filings when appropriate, 


including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 


Nixon y. Warner Communications, ne., 435 U.S. 589, 598 (1978)). The Court may also seal the - 


Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

Z; In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 


“district court of the United States .. . that — has jurisdiction over the offense being investigated.” 
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18 U.S.C. § 2711@)(A)(@). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

. 3, Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. $ 2705(0). Apple provides an “electronice communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Apple may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(1)(A) allows the 
Government to obtain contents of communications using a search warrant, See 18 U.S.C. § 2703. 

4. The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703, However, many have voluntarily 


adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 


Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such ¢ 


notification. In relevant part, Section 2705(b) provides as follows: 


(b) Preclusion of notice to subject of governmental access, —- A governmental 
entity acting under section 2703 . . . may apply to a court for an order commanding 
a provider of electronic communications service or remote computing service to 
whom a warrant, subpoena, or court order is directed, for such period as the court 
deems appropriate, not to notify any other person of the existence of the warrant, 
subpoena, or court order. The court shall enter such an order if it determines that 
there is reason to believe that notification of the existence of the warrant, subpoena, 
or court order will result in— 

(1) endangering the life or physical safety of an individual; 

(2) flight from prosecution; 


l Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
ander that provision. 
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(3) destruction of or tampering with evidence; 
(4) intimidation of potential witnesses; or 
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 
requisite showing about potential consequences of notification: 
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the . 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 
in re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #G.J2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C, 2014). 
5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Apple not to notify any other person (except attorneys for Apple for the purpose of 


receiving legal advice) of the existence of the Subpoena for a period of one year or until further 


order of the Court. 


FACTS SUPPORTING SEALING AND NON-DISCLOSURE 

6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S.C. 
§ 2 (aiding and abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a 
felony), 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 951 (acting as an unregistered foreign agent), 
18 U.S.C. § 1030 (unauthorized access of a protected computer); 18 U.S.C. § 1343 (wire fraud), 
18 U.S.C. § 1349 (attempt and conspiracy to commit wire fraud), and 22 U.S.C. § 611 et seq. 
(Foreign Agents Registration Act), and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject 
Offenses”), in connection with efforts to compromise the networks of the Democratic National 


Convention (“DNC”), the Democratic Congressional Campaign Committee (“DCCC”), and the 
3 
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email accounts of U.S. persons, followed by the public release of stolen materials through various 
outlets. 


7. In this matter, the government requests that the Warrant be sealed until further order 


of the Court and that Apple and its employees be directed not to notify any other person of the ` 


existence or content of the Warrant (except attorneys for Apple for the purpose of receiving legal 
advice) for a period of one year or until further order of the Court. Such an order is appropriate 
because the Warrant relates to an ongoing criminal investigation, the scope and nature of which is 
neither public nor known to the targets of the investigation, and its disclosure may alert these 
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant and 
related papers may also alert the targets to the scope of information known to the FBI. Once alerted 
to this information, potential targets would be immediately prompted to destroy or conceal 
incriminating evidence, dite their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic communication and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity. 

8, Given the complex and sensitive nature of the criminal activity under. investigation, 
and also given that the criminal ihai may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change sich that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief, 

9. There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 


to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 
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§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
compelling governmental interest in confidentiality to justify the government?s sealing request. 
See Robinson, 935 F.2d at 287-89, 

10. . Based on prior dealings with Apple, the United States is aware that, absent a court 
order under Section 2705(b) commanding Apple not to notify anyone about a legal request, Apple 
may, upon receipt of a warrant seeking the contents of electronically stored wire or electronic 
communications for a certain account, notify the subscriber or customer of the existence of the 
watrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned watrant, the application and affidavit in support thereof, and all attachments 
thereto’and other related materials be placed under seal, and furthermore, that the Court command 
Apple not to notify any other person of the existence or contents of the above-captioned warrant 
(coe attorneys for Apple for the purpose of receiving legal advice) for a period of one year or 
until further order of the Court. 


Respectfully submitted, 


ROBERT S. MUELLER, IIT 
Special Counsel 


Dated: P/2FAG By: 


Special Counsel’s Office 
(202) 616-3812 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
District of Columbia 

In the Matter of the Search of 

tne Ma er of the Search o ) Case: 1:18-sc-02994 
(Briefly describe the property to be searched ) : : B IA 
or identify the person by name and address) ) Assigned To: jeps H s 

INFORMATION ASSOCIATED WITH FOUR ) Assign. nl E SEALED 
ACCOUNTS STORED AT PREMISES ) Description: i 
CONTROLLED BY GOOGLE ) 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Northern | District of California 


(identify the person or describe the property to be searched and give its location): 


See Attachment A 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B 


YOU ARE COMMANDED to exccute this warrant on or before October 18, 2018 (not to exeeed 14 days) 
M in the daytime 6:00 a.m. to 10:00 p.m. ‘at any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 


as required by law and promptly return this warrant and inventory to _ Hon. Beryl A. Howell, Chief U.S. District Judge . 
(United States Magistrate Judge) 


O Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 

O for days (not to exceed 30) © until, the facts justifying, the later specific date of 


Date and time issued: SAD ALR af 2/dby f Aa 7. fie — 


Judge’s signature 


City and state: Washington, DC Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Date and time warrant executed: Copy of warrant and inventory left with: 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the Google accounts registered to the 
following email addresses, which are stored at premises owned, maintained, controlled, or 


operated by Google, LLC (“Google”), a company headquartered in Mountain View, California: 
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ATTACHMENT B 


I. Information to be disclosed by Google 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 


information that have been deleted but are still available to Google, or have been preserved 


pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 


information to the government for each account listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

The types of service utilized; 

All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 
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é: All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 


actions taken; 


f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; ` 

h. All location and maps information associated with the account; 

i. All Google Analytics information associated with the account (including all 


properties and UA codes associated with the account, and, for each of these 


proprieties and UA codes, all usernames and email accounts associated with them); 


j. All Google Developers Console information associated with the account; 
'k. All Minutemaid information associated with the account; 

L. All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; 


q. All Web & App Activity associated with the account; 


f; All Google Drive information associated with the account; 
s. All Google+ information associated with the account; 
t All device information associated with the account, including all instrument or 


telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 


Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities “IMEI’)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 
II. Information to be Seized by the Government 
Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from March 1, 2016 to the present, including: 


oA 
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a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 


b. All records, information, documents or tangible materials that relate in any way to 


communications or meetings involving Jerome i i=” Julian 


individual associated with the Trump Campaign, any witness in the investigation; 

c. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

€. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; : 

f Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 


any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context of account access, use, and events relating 


to the crimes under investigation and to the account owner; 


h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 
i. The identity of the person(s) who created or used the account, including records 


that help reveal the whereabouts of such person(s); 

ji Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account, 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

l. The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s}—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)}—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 


in subsection II.a. 


aa 
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Ill. Review Protocols 


Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 


DA 
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UNITED STATES DISTRICT COURT OCT -53 


for the Clerk, U.S. Distri€t anu 


District of Columbia nkruptcy Courts 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 
INFORMATION ASSOCIATED WITH 
FOUR ACCOUNTS STORED AT PREMISES 


CONTROLLED BY GOOGLE 


Case: 1:18-sc-02994 
Assigned To : Howell, Beryl A. 
Assign. Date : 10/5/2018 
Description: USA v. SEALED 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 


located in the Northern 
person or describe the property to be seized): 


See Attachment B 


District of —__ _ California i , there is now concealed (identify the 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
© evidence of a crime; 
Sf contraband, fruits of crime, or other items illegally possessed; 
@ property designed for use, intended for use, or used in committing a crime; 


O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
52 U.S.C. § 30121 Foreign Contribution Ban 
18 U.S.C. §§ 1001, 1030,371 False Statements, Unauthorized Access of Protected Computer, Conspiracy 


See Affidavit for add'l 


The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


> aai 


a 
pae 


Reviewed by AUSA/SAUSA: Applicant's signature 
Kyle R. Freeny (ASC) f Patrick J. Myers, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


pate: A | [Dl hdr 


Judge's signature 


City and state: Washington, D.C. = —ć— =< l Hon. Beryl A. Howell, Chief U.S. District Judge 
Printed name and title 
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OCT -5 2018 


IN THE UNITED STATES DISTRICT COURTClerk; U.S. District and 
FOR THE DISTRICT OF COLUMBIA Bankruptcy Courts 


IN THE MATTER OF THE SEARCH OF , Case: 1:18-sc—02994 

INFORMATION ASSOCIATED WITH Assigned To : Howell, Beryt A. 

FOUR ACCOUNTS STORED AT , Assign. Date : 10/5/2018 

PREMISES CONTROLLED BY GOOGLE |? Description: USA v. SEALED 
AFFIDAVIT IN SUPPORT OF 


AN APPLICATION FOR A SEARCH WARRANT 


I, Patrick J. Myers, being first duly sworn, hereby depose and state as follows: 


INTRODUCTION AND AGENT BACKGROUND 


l; I make this affidavit in support of an application for a search warrant for 


information associated with accounts 


of the information described in Attachment A, government-authorized persons will review that 
information to locate the items described in Attachment B. 

2: Iam a Special Agent with the Federal Bureau of Investigation (“FBI”) ce to 
FBI Pittsburgh working directly with the Special Counsel’s Office. I have been a Special Agent 
with the FBI since 2017. I was previously employed as a network and software engineer for 
approximately fifteen years, including for the FBI. As a Special Agent, I have conducted national 


security investigations relating to foreign intelligence and cybersecurity. 
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3. The facts in this affidavit come from my personal observations, my training and 
experience, and information obtained from other FBI personnel and witnesses. This affidavit is 
intended to show merely that there is sufficient probable cause for the requested warrant and 
does not set forth all of my knowledge about this matter. 

4. Based on my training and experience and the facts as set forth in this affidavit, 
there is probable cause to believe that the Target Accounts contains evidence, fruits, or 
instrumentalities of violations of 18 U.S.C. § 371 (conspiracy), 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized access of a protected 
computer), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud), 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. § 1513 (witness 
tampering), and 52 U.S.C. § 30121(a)(1)(C) (foreign expenditure ban). There also is probable 
cause to search the information described in Attachment A for evidence, contraband, fruits, 
and/or instrumentalities of the Subject Offenses, further described in Attachment B. | 

JURISDICTION 

5. This Court has jurisdiction to issue the requested warrant because it is “a court of 
competent jurisdiction” as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)X(1)(A), & 
(c)(1)(A). Specifically, the Court is “a district court of the United States (including a magistrate 
judge of such a court) . . . that has jurisdiction over the offense being investigated.” 18 U.S.C. 


§ 2711(3)(A)(i). The offense conduct included activities in Washington, D.C., as detailed below. 


ija 
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PROBABLE CAUSE 
A. Background on Relevant Individuals 
i. Roger STONE 
6. Roger STONE is a self-employed political strategist/consultant and has been 
actively involved in U.S. politics for decades. STONE worked on the presidential campaign of 
Donald J. Trump (the “Campaign”) until August 2015. Although Stone had no official 
relationship with the Campaign thereafter, STONE maintained his support for Trump and 
continued to make media appearances in support of the Campaign. As described further below, 
STONE also maintained contact with individuals employed by the Campaign, including then- 
campaign chairman Paul MANAFORT and deputy chairman Rick GATES. 
ii. Jerome CORSI 
79 Jerome CORSI is a political commentator who, according to publicly available 
information, served as the “Washington Bureau Chief for Inforwars.com.” According to 
publicly-available sources, from 2014 until January 2017, CORSI was a “senior staff reporter” 
for the website “World Net Daily” a/k/a “WND.com.” CORSI has also written a number of 
books regarding Democratic presidential candidates. As described further below, CORSI was in 
contact with STONE during the summer and fall of 2016 regarding forthcoming disclosures of 


hacked information by WikiLeaks, and appears to have obtained information regarding 


upcoming disclosures which he relayed to STONE. 
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B. Russian Government-Backed Hacking Activity During the 2016 Presidential 


Election 


9: On January 6, 2017, the USIC released a declassified version of an intelligence 
assessment of Russian activities and intentions during the 2016 presidential election entitled, 


“Assessing Russian Activities and Intentions in Recent US Elections.” In the report, the USIC 


assessed the following: 


[] Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the 
US presidential election. Russia’s goals were to undermine public faith in the US 
democratic process, denigrate [former] Secretary [of State Hillary] Clinton, and harm her 
electability and potential presidency. We further assess Putin and the Russian 
Government developed a clear preference for President-elect Trump. 


10.  Inits assessment, the USIC also described, at a high level, some of the techniques 
that the Russian government employed during its interference. The USIC summarized the efforts 
as a “Russian messaging strategy that blends covert intelligence operations—such as cyber 
activity—with overt efforts by Russian Government agencies, state-funded media, third-party 


299 


intermediaries, and paid social media users or ‘trolls. 


11. With respect to “cyber activity,” the USIC assessed that “Russia’s intelligence 


ia 
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services conducted cyber operations against targets associated with the 2016 US presidential 
election, including targets associated with both major US political parties.” Further, “[i]n July 
2015, Russian intelligence gained access to Democratic National Committee (DNC) networks 
and maintained that access until at least June 2016.” The USIC attributed these cyber activities 
to the Russian GRU, also known as the Main Intelligence Directorate: “GRU operations resulted 
in the compromise of the personal e-mail accounts of Democratic Party officials and political 
figures. By May, the GRU had exfiltrated large volumes of data from the DNC.” 

12. With respect to the release of stolen materials, the USIC assessed “with high 
confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to 
release US victim data obtained in cyber operations publicly and in exclusives to media outlets.” 

13.  Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple 
contradictory statements and false claims about his identity throughout the election. 

14. The Special Counsel’s Office has determined that individuals associated with the 
GRU continued to engage in hacking activity related to the 2016 presidential election through at 
least November 1, 2016. 

15. For example, in or around September 2016, these individuals successfully gained 
access to DNC computers housed on a third-party cloud-computing service. In or around late 
September, these individuals stole data from these cloud-based computers by creating backups of 
the DNC’s cloud-based systems using the cloud provider’s own technology. The individuals 
used three new accounts with the same cloud computing service to move the “snapshots” to 
those accounts. 

16. On or about September 4, 2016, individuals associated with the GRU stole the 


emails from a former White House advisor who was then advising the Clinton Campaign. These 
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emails were later post on DCLeaks. 

17. On or about November 1, 2016, individuals associated with the GRU 
spearphished over 100 accounts used by organizations and personnel involved in administering 
elections in numerous Florida counties. 

18. On July 13, 2018, a grand jury in the District of Columbia returned an indictment 
against twelve Russia military officers for criminal offenses related to efforts to influence the 2016 
presidential election, including conspiracy to commit authorized access to protected computers. 
See United States v. Viktor Borisovich Netyksho, et al. (Case No. 1:18-cr-00125). 

C. STONE’s Public Interactions with Guccifer 2.0 and WikiLeaks 

19. On June 14, 2016, CrowdStrike, the forensic firm that sought to remediate an 
unauthorized intrusion into the computer systems of the DNC, publicly attributed the hack to 
Russian government actors and the media reported on the announcement. On June 15, 2016, the 
persona Guccifer 2.0 appeared and publicly claimed responsibility for the DNC hack. It stated 
on its WordPress blog that, with respect to the documents stolen from the DNC, “[t]he main part 
of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” 
In that post, Guccifer 2.0 also began releasing hacked DNC documents. 

20. On July 22, 2016, WikiLeaks published approximately 20,000 emails stolen from 
the DNC. 

21. On August 5, 2016, STONE published an article on Breitbart.com entitled, “Dear 
Hillary: DNC Hack Solved, So Now Stop Blaming Russia.” The article stated: “It doesn’t seem 
to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 
2.0.” The article contained embedded publicly available Tweets from Guccifer 2.0 in the article 


and stated: “Here’s Guccifer 2.0’s website. Have a look and you’!I see he explains who he is and 
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why he did the hack of the DNC.” Thè article also stated: “Guccifer 2.0 made a fateful and wise 
decision. He went to WikiLeaks with the DNC files and the rest is history. Now the world would 
see for themselves how the Democrats had rigged the game.” 

22; On August 8, 2016, STONE addressed the Southwest Broward Republican 
Organization. During his speech, he was asked about a statement by WikiLeaks founder Julian 
ASSANGE to Russia Today (RT) several days earlier about an upcoming “October Surprise” 
aimed at the Hillary Clinton presidential campaign. Specifically, STONE was asked: “With 
regard to the October surprise, what would be your forecast on that given what Julian Assange 
has intimated he’s going to do?” STONE responded: “Well, it could be any number of things. I 
actually have communicated with Assange. I believe the next tranche of his documents pertain 
to the Clinton Foundation but there’s no telling what the October surprise may be.” A few days 
later, STONE clarified that while he was not personally in touch with ASSANGE, he had a close 
friend who served as an intermediary. 

23. On August 12, 2016, Guccifer 2.0 publicly tweeted: “@RogerJStoneJr thanks that 
u believe in the real #Guccifer2.” That same day, Guccifer 2.0 released the personal cellphone 
numbers and email addresses from the files of the DCCC. 

24. On August 13, 2016, STONE posted a tweet using @RogerJStoneJr calling 
Guccifer 2.0 a “HERO” after Guccifer 2.0 had been banned from Twitter. The next day, 
Guccifer 2.0’s Twitter account was reinstated. 

25; On August 17, 2016, Guccifer 2.0 publicly tweeted, “@RogerJStoneJr paying you 
back.” Guccifer also sent a private message to @RogerJStoneJr stating “i’m pleased to say ur 
great man. please tell me if I can help u anyhow. it would be a great pleasure to me.” 


26. On August 18, 2016, Paul MANAFORT, STONE’s longtime friend and associate, 
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resigned as Chairman of the Trump Campaign. Contemporary press reports at the time indicated 
that MANAFORT had worked with a Washington D.C.-based lobbying firms to influence U.S. 
policy toward Ukraine. 

27. On August 21, 2016, using @RogerJStoneJR, STONE tweeted: “Trust me, it will 
soon the [sic] Podesta’s time in the barrel. #CrookedHillary.” In a C-SPAN interview that same 
day, STONE reiterated that because of the work of a “‘mutual acquaintance’ of both his and 
[ASSANGE], the public [could] expect to see much more from the exiled whistleblower in the 
form of strategically-dumped Clinton email batches.” He added: “Well, first of all, I think Julian 
Assange is a hero... I think he’s taking on the deep state, both Republican and Democrat. I 
believe that he is in possession of all of those emails that Huma Abedin and Chery] Mills, the 
Clinton aides, believe they deleted. That and a lot more. These are like the Watergate tapes.” 

28. On September 16, 2016, STONE said in a radio interview with Boston Herald 
Radio that he expected WikiLeaks to “drop a payload of new documents on Hillary on a weekly 
basis fairly soon. And that of course will answer the question as to what exactly what was erased 
on that email server.” 

29. On Saturday, October 1, 2016, using @RogerJStoneJr, STONE tweeted, 
“Wednesday @ HillaryClinton is done. #WikiLeaks.” 

30. On Sunday, October 2, 2016, MSNBC Morning Joe producer Jesse Rodriquez 
tweeted regarding an announcement ASSANGE had scheduled for the next day from the balcony 
of the Ecuadoran Embassy in London. On the day of the ASSANGE announcement — which was 
part of WikiLeaks’ 10-year anniversary celebration — STONE told Infowars that his intermediary 
described this release as the “mother load.” On October 5, 2016, STONE used @RogerJStoneJr 


to tweet: “Payload coming. #Lockthemup.” 
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31. On Friday, October 7, 2016, at approximately 4:03 PM, the Washington Post 
published an article containing a recorded conversation from a 2005 Access Hollywood shoot in 
which Mr. Trump had made a series of lewd remarks. 

32. Approximately a half hour later, at 4:32 PM, WikiLeaks sent a Tweet reading 
“RELEASE: The Podesta Emails #HillaryClinton #Podesta #imWithHer” and containing a link 
to approximately 2,050 emails that had been hacked from John Podesta’s personal email account. 

33. WikiLeaks continued to release John Podesta’s hacked emails through Election 
Day, November 8, 2016. On October 12, 2016, Podesta — referring back to STONE’s August 21, 
2016 C-SPAN and Twitter references — argued publicly that “[it is] a reasonable assumption to - 
or at least a reasonable conclusion - that [STONE] had advanced warning [of the release of his 
emails] and the Trump campaign had advanced warning about what Assange was going to do. I 
think there’s at least a reasonable belief that [Assange] may have passed this information on to 
[STONE].” Commenting to the NBC News, STONE indicated that he had never met or spoken 
with Assange, saying that “we have a mutual friend who’s traveled to London several times, and 
everything I know is through that channel of communications. I’m not implying I have any 
influence with him or that I have advanced knowledge of the specifics of what he is going to do. 
I do believe he has all of the e-mails that Huma Abedin and Cheryl Mills, the Clinton aides, 
thought were deleted. I hear that through my emissary.” 

34. On March 27, 2017, CNN reported that a representative of WikiLeaks, writing 
from an email address associated with WikiLeaks, denied that there was any backchannel 
communication during the Campaign between STONE and WikiLeaks. The same article quoted 
STONE as stating: “Since I never communicated with WikiLeaks, I guess I must be innocent of 


charges I knew about the hacking of Podesta’s email (speculation and conjecture) and the timing 
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or scope of their subsequent disclosures. So I am clairvoyant or just a good guesser because the 
limited things I did predict (Oct disclosures) all came true.” 
D. STONE?’s Private Twitter Direct Messages with WikiLeaks and ASSANGE 

35. On October 13, 2016, while WikiLeaks was in the midst of releasing the hacked 
Podesta emails, the Twitter account @RogerJStoneJr sent a private direct message to the Twitter 
account @wikileaks.! The latter account is the official Twitter account of WikiLeaks and has 
been described as such by numerous news reports. The message read: “Since I was all over 
national TV, cable and print defending WikiLeaks and assange against the claim that you are 
Russian agents and debunking the false charges of sexual assault as trumped up bs you may want 
to rexamine the strategy of attacking me- cordially R.” 

36. Less than an hour later, @wikileaks responded by direct message: “We appreciate 
that. However, the false claims of association are being used by the democrats to undermine the 
impact of our publications. Don’t go there if you don’t want us to correct you.” 

37. On or about October 15, 2016, @RogerJStoneJr sent a direct message to 
@wikileaks: “Ha! The more you \"correct\" me the more people think you’re lying. Your 
operation leaks like a sieve. You need to figure out who your friends are.” 

38. On or about November 9, 2016, one day after the presidential election, 
@wikileaks sent a direct message to @RogerJStoneJr containing a single word: “Happy?” 
@wikileaks immediately followed up with another message less than a minute later: “We are 


now more free to communicate.” 


39. In addition, @RogerJStoneJr also exchanged direct messages with ASSANGE, 


! On or about August 7, 2017, Chief Judge Beryl A. Howell issued a search warrant for the 
Twitter account @RogerJStoneJr. 
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the founder of WikiLeaks. For example, on June 4, 2017, @RogerJStoneJr directly messaged 
@JulianAssange, an address associated with ASSANGE in numerous public reports, stating: 
“Still nonsense. As a journalist it doesn’t matter where you get information only that it is 
accurate and authentic. The New York Times printed the Pentagon Papers which were 
indisputably stolen from the government and the courts ruled it was legal to do so and refused to 
issue an order restraining the paper from publishing additional articles. If the US government 
moves on you I will bring down the entire house of cards. With the trumped-up sexual assault 
charges dropped I don’t know of any crime you need to be pardoned for - best regards. R.” That 
same day, @JulianAssange responded: “Between CIA and DoJ they’re doing quite a lot. On the 
DoJ side that’s coming most strongly from those obsessed with taking down Trump trying to 
squeeze us into a deal.” 

40. On Saturday, June 10, 2017, @RogerJStoneJr sent a direct message to 
@JulianAssange, reading: “I am doing everything possible to address the issues at the highest 
level of Government. Fed treatment of you and WikiLeaks is an outrage. Must be circumspect in 


this forum as experience demonstrates it is monitored. Best regards R.” 


E. CORSI’s Communications with ston: and Others Regarding 
Forthcoming Leaks 


41. On September 11, 2017, Chief Judge Beryl A. Howell of the District of Columbia 


issued a search warrant for STONE’s nn. ii On October 17, 


2017, Chief Judge Howell issued a search warrant for one of STONE fh caresses, 


ee © or about December 19, 2017, Chief Judge Howell issued a search 


warrant o email account. On or about March 14, 2018, Chief Judge Howell 


issued a search warrant for STONE’s iCloud account. Information recovered pursuant to those 


search warrants indicated the following: 


E 
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42. On or about May 15, 2016, EE cites CORSI: “Here is my flight 


schedule. Need to get something confirmed now . . . .” CORSI responded, “I copied Roger 
Stone so he knows your availability to meet Manafort and DT this coming week.” CORSI 


appears to have forwarded the message to STONE at 0O ::: replied to 


CORSI that, “May meet Manafort -guarantee nothing.” 


43.  Onor about May 18, 2016, CORSI emailed STONE e is 


with the title, “Roger -- why don't you look this over before I send it | believe that 


CORSI wrote, 


d I did manage to see Mr. Trump for a few minutes today as we were 
waiting in Trump Tower to say hello to Mike Cohen. Mr. Trump recognized us immediately and 


was very cordial. He would look for this memo from you this afternoon.” 


44. On July 25, 2016, STONE, 2 B an email to 


CORSI with the subject line, “Get to Assange.” The body of the message read: “Get to Assange 


[a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails. ..they deal with 


Foundation, allegedly.” 


45. On or about July 31, 2016, STONE, using O= R 


CORSI with the subject line, “Call me MON.” The body of the email read: | see 


Assange[.] |e find Bernie [Sanders brother who called Bill a Rapist — turn him for 


Trump[.] | DN ~ if more proof of Bill getting kicked out.” 


46. On or about August 2, 2016 (approximately 19 days before STONE publicly 


tweeted about “Podesta’s time in the barrel”), CORSI emailed STONE at 


ae |... is friend in embassy plans 2 more dumps. One shortly after ’m 


back. 2nd in Oct. Impact planned to be very damaging.” The email continued, “Signs are Fox 


EDA 
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will have me on mid-Aug. more post Ailes shakeup underway. Expect Shine to surface victor, 
for now. Post-DNC bump for HRC an artifact of rigged polling. Won’t last. I expect presidential 
campaign to get serious starting Sept. Still in pre-season games. Time to let more than Podesta to 
be exposed as in bed w enemy if they are not ready to drop HRC. That appears to be the game 
hackers are now about. Would not hurt to start suggesting HRC old, memory bad, has stroke -- 
neither he nor she well. I expect that much of next dump focus, setting stage for Foundation 
debacle.” Investigators believe that CORSI’s reference to a “friend in embassy [who] plans 2 


more dumps” refers to ASSANGE, who resided in Ecuador’s London Embassy in 2016. 


47. On or about August 5, 2016, 2 i an associate of STONE’s, emailed 
STONE at ———-) The email contained a link to a poll indicating that Clinton 


led Trump by 15 points. STONE responded “enjoy it while u can{.] I dined with my new pal 
Julian Assange last night.” a stated to investigators that, around the 
same time, STONE told him he had gone to London to meet assanc: also stated 
that in w STONE he would be interviewed by the FBI and would have to 
divulge the conversation about meeting ASSANGE. STONE told oOo g was joking and 


had not actually met ASSANGE.? 


48. Through a search of STONE’s iCloud account, the FBI has uncovered evidence 


suggesting that STONE was in Los Angeles for one or more meetings at the time that he claimed, 


in his email to /=— to have “dined” with ASSANGE. For example, an associate of 
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STONE sent a text to STONE at approximately 3:38PM on August 2, asking “How did ur meeting 
go in LA?” STONE responded. “It’s this afternoon[.]” The following day, the associate asked, 
“Any report from ur meeting?” On or about August 4, 2016, STONE texted the associate, “Will 
call later — heading for airport now[.]” Additionally, investigators have identified a photograph in 
STONE’s iCloud that appears to have been taken on August 3, 2016 and had geo-location 
information indicating that it was taken in Los Angeles. 
49. On or about August 15, 2016, CORSI emailed STONE at 

a “Give me a call today if you can. Despite MSM drumroll that HRC is 
already elected, it’s not over yet. More to come than anyone realizes. Won’t really get started 
until after Labor Day. I’m in NYC this week. Jerry.” 


50. On or about August 31, 2016, CORSI emailed STONE at 


“Did you get the PODESTA writeup.” STONE replied “[y]es.” 

51. On or about August 31, 2016, CORSI messaged STONE, “Podesta paid $180k to 
invest in Uranium One — was hired by Rosatom in Giustra scandal. Podesta now under FBI 
investigation — tied to Ukraine Yanukovych — Panama papers reveals Podesta hired by 
S[b]erbank, Russia’s largest financial institution — Podesta $$$ ties to Russia undermine Clinton 
false narrative attempting to tie Trump to Putin.” 

52, On or about September 6, 2016, CORSI emailed STONE at 

= BR Is NY Post going to use the Pedesta [sic] stuff?” 

53. On or about September 24, 2016 O CORSI, “I will have much 

more on Turkey. Need a back channel highly sensitive stuff.” CORSI responded, “We have 


secure back channel through Roger. I saw him again in NYC last Friday and spoke to him about 
it again TH g back, “Awaiting secret file. Explosive... Hope you are well. 


“a: 
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Can't wait for the debate. Channeling Reagan, I hope!” CORSI responded, “Keep me posted 
about file[.]” In a subsequent meeting with investigators indicated this 
conversation concerned possible derogatory information he was trying to obtain from Turkey. 

54. On or about October 3, 2016, an associate of STONE emailed STONE at 

Oo ::: asked: “Assange — what’s he got? Hope it’s good.” STONE wrote 
back, “It is. I’d tell Bannon but he doesn’t call me back. My book on the TRUMP campaign will 
be out in Jan. Many scores will be settled.” The associate forwarded the email to Steve 
BANNON, who was CEO of the Campaign at the time, and wrote: “You should call Roger. See 
below. You didn’t get from me.” BANNON wrote back, “I’ve got important stuff to worry 
about.” The associate responded, “Well clearly he knows what Assange has. I’d say that’s 
important.” 

55. On or about October 4, 2016, ASSANGE gave a press conference at the 
Ecuadorian Embassy. There had been speculation in the press leading up to that event that 
ASSANGE would release information damaging to then-candidate Clinton, but WikiLeaks did 
not make any new releases. Instead, ASSANGE promised more documents, including 
information “affecting three powerful organizations in three different states, as well as, of course, 
information previously referred to about the U.S. election process.” ASSANGE also stated that 
WikiLeaks would publish documents on various subjects every week for the next ten weeks, and 
vowed that the U.S. election-related documents would all come out before Election Day. 

56. On or about October 4, 2016, CORSI messaged STONE at his iCloud account: 
“Assange made a fool of himself. Has nothing or he would have released it. Total BS hype.” 


Ik That same day, BANNON emailed STONE at a “What was 


that this morning???” STONE replied, “Fear. Serious security concern. He thinks they are going 
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to kill him and the London police are standing done [sic].” BANNON wrote back, “He didn’t 
cut deal w/ clintons???” STONE replied, “Don't think so BUT his lawyer a: a big 
democrat.” 

58. When BANNON spoke with investigators during a voluntary interview on 
February 14, 2018, he initially denied knowing whether the October 4, 2016 email to STONE 
was about WikiLeaks. Upon further questioning, BANNON acknowledged that he was asking 
STONE about WikiLeaks, because he had heard that STONE had a channel to ASSANGE, and 
BANNON had been hoping for releases of damaging information that morning. 


F. STONE and CORSI Communications on October 7, 2016, when the Podesta Emails 
Are Released. 


59. According to a publicly available news article,? at approximately 11AM on 
Friday, October 7, 2016, Washington Post reporter David Fahrenthold received a phone call from 
a source regarding a previously unaired video of candidate Trump. According to the same 
article, “Fahrenthold didn’t hesitate. Within a few moments of watching an outtake of footage 
from a 2005 segment on ‘Access Hollywood,’ the Washington Post reporter was on the phone, 
calling Trump’s campaign, ‘Access Hollywood,’ and NBC for reaction.” 

60. According to phone ont i at approximately 
11:27 AM, CORSI placed a call to STONE, which STONE did not answer. 

61. At approximately 11:53AM, STONE received a phone call from the Washington 
Post. The call lasted approximately twenty minutes. 

62. At approximately 1:42PM, STONE called CORSI and the two spoke for 


approximately seventeen minutes. 


3 https://www.washingtonpost.com/lifestyle/style/the-caller-had-a-lewd-tape-of-donald-trump- 
then-the-race-was-on/2016/10/07/31d74714-8ce5-1 1e6-875e-2c1 bfe943b66_story.html 


sjó: 
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63. At approximately 2:18PM, CORSI called STONE and the two spoke for 
approximately twenty minutes. 

64. At approximately 4:00PM, the Washington Post published a story regarding the 
Access Hollywood tape. 

65. At approximately 4:30PM, WikiLeaks tweeted out its first release of emails 
hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. 


On or about August 2, 2016, CORSI emailed STONE vin E expect 


that much of next dump focus, setting stage for Foundation debacle.” 


66. At approximately 6:27PM, io an author who has written about the 


Clinton Foundation, and who, according to emails and phone records, regularly communicates 
with STONE, sent STONE an email titled, “WikiLeaks — The Podesta Emails,” with a link to the 
newly-released Podesta emails. Approximately ten minutes later, STONE, using 


ioe forwarded OR to CORSI without comment. STONE 


does not appear to have forwarded the email to any other individual. 


G. STONE Asks CORSI for “SOMETHING” to Post About Podesta After STONE Is 
Accused of Advance Knowledge of the Leak 


67. On or about October 8, 2016, STONE messaged CORSI, “Lunch postponed — 
have to go see T.” CORSI responded to STONE, “Ok. I understand.” Approximately twenty 
minutes later, CORSI texted, “Clintons know they will lose a week of Paula Jones media with T 
attacking Foundation, using Wikileaks Goldman Sachs speech comments, attacking bad job 


numbers.” 


68. On or about Wednesday, October 12, 2016, at approximately 8:17AM, STONE, 


=i iia emailed Corsi asking him to “send me your best podesta links.” 


STONE emailed CORSI at approximately 8:44AM EDT, “need your BEST podesta pieces.” 
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CORSI wrote back at approximately 8:54AM EDT, “Ok. Monday. The remaining stuff on 
Podesta is complicated. Two articles in length. I can give you in raw form the stuff I got in 
Russian translated but to write it up so it’s easy to understand will take weekend. Your choice?” 

69. On or about that same day, October 12, 2016, Podesta accused STONE of having 
advance knowledge of the publication of his emails. At approximately 3:25PM EDT, CORSI 
emailed STONE at both oe a a ee with the subject 
line “Podesta talking points.” Attached to the email was a file labeled, “ROGER STONE 
podesta talking points Oct 12 2016.docx.” The “talking points” included the statement that 
“Podesta is at the heart of a Russian-government money laundering operation that benefits 
financially Podesta personally and the Clintons through the Clinton Foundation.” 

70. CORSI followed up several minutes later with another email titled, “Podesta 
talking points,” with the text “sent a second time just to be sure you got it.” STONE emailed 


CORSI back via the | OR “Got them and used them.” 


Ti On or about Thursday, October 13, 2016, CORSI emailed STONE at 
fo. “PODESTA -- Joule & ties to RUSSIA MONEY LAUNDERING to 
CLINTON FOUNDATION.” STONE responded, “Nice but I was hoping for a piece I could 
post under my by-line since I am the one under attack by Podesta and now Mook.” CORSI 
wrote back to STONE, “I’ll give you one more — NOBODY YET HAS THIS[:] It looks to me 
like | RE maybe billions off Skolkovo — Skolkovo kept their money with 
Metcombank[.] The Russians launched a criminal investigation[.] [web link] Once a 
had the channel open from Metcombank to Deutsche Bank America to Ban[k] of America’s 
Clinton Fund account, there’s no telling how much money he laundered, or where it ended up. 


Nothing in Clinton Foundation audited financials or IRS Form 990s about $$$ received via 
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Russia & Metcombank[.] I’m working on that angle now.” STONE replied, “Ok Give me 
SOMETHING to post on Podesta since I have now promised it to a dozen MSM reporters[.]” 

72. On or about Thursday, October 13, 2016 at approximately 6:30PM EDT, CORSI 
sent STONE an email at OOO the subject, “ROGER STONE article 
RUSSIAN MAFIA STYLE MONEY-LAUNDERING, the CLINTON FOUNDATION, and 
JOHN PODESTA.” The text stated: “Roger[,] You are free to publish this under your own 
name.” That same day, STONE posted a blog post with the title, “Russian Mafia money 
laundering, the Clinton Foundation and John Podesta.” In that post, STONE wrote, “although I 
have had some back-channel communications with Wikileaks I had no advance notice about the 
hacking of Mr. Podesta nor I have I ever received documents or data from Wikileaks.” The post 
then asked, “Just how much money did eee a controversial Russian billionaire 
investor with ties to the Vladimir Putin and the Russian government, launder through 
Metcombank, a Russian regional bank owned 99.978 percent D EG the money 
transferred via Deutsche Bank and Trust Company Americas in New York City, with the money 
ending up in a private bank account in the Bank of America that is operated by the Clinton 
Foundation?” 

73. On or about October 14, 2016, CORSI sent a message to STONE at bis iCloud 
account, “I’m in NYC. Thinking about writing piece attacking Leer and other women. It’s 
basically a rewrite of what’s out there. Going through new Wikileaks drop on Podesta.” 

74. On or about October 17, 2016, CORSI messaged STONE at his iCloud account, 
“On Assange, can you call me now — before 2pm[.]” STONE responded, “Missed u — just 
landed JFK — on Infowars now.” CORSI wrote back, “Call afterwards. Have some important 


intel to share.” 
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DD: On or about October 17, 2016, CORSI emailed STONE at 
ee the subject, “Fwd: 
ASSANGE...URGENT...” CORSI wrote, “From a very trusted source,” and forwarded an email 
with the header information stripped out, showing only the body text. The email read, “Yes[.] I 
figured this. Assange is threatening Kerry, Ecuador and U.K. He will drop the goods on them if 
they move to extradite him. My guess is that he has a set of dead man files that include Hillary. 
It’s what they used to call a ‘Mexican stand off[.]’ Only hope is that if Trump speaks out to save 
him[.] Otherwise he’s dead anyway, once he’s dropped what he has. If HRC wins, Assange can 
kiss his life away. Interesting gambit Assange has to play out. He’s called Podesta’s bluff and 
raised him the election.” Based on review of the original email that CORSI forwarded, the 
“trusted source” was a self-identified retired librarian who gathers information from public chat 


rooms, 


76. On or about October 18, 2016, CORSI messaged STONE at his iCloud account, 
“Pls call. Important.” 

77. Onor about October 19, 2016, STONE published an article on Breitbart.com in 
which he claimed he had, “no advance notice of Wikileaks’ hacking of Podesta’s e-mails.” 
STONE stated that, “I predicted that Podesta’s business dealings would be exposed. I didn’t hear 
it from Wikileaks, although Julian Assange and J share a common friend. I reported the story on 
my website.” STONE linked to the story he had asked CORSI to write for him on October 13, 
2016 discussed above. 

78. On or about November 8, 2016, the United States presidential election took place. 

79. On or about November 9, 2016, CORSI messaged STONE at his iCloud account, 


“Congratulations, Roger. He could not have done it without you.” 


270s 


Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 31 of 60 


80. On or about November 10, 2016, CORSI messaged STONE at his iCloud 


account, “Are you available to talk on phone?” Several minutes later, CORSI messaged, “I’m in 


London. Have some interesting news for you.” 
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I. STONE’s Congressional Testimony and Public Statements About His Relationship 
with Wikileaks 


88. On September 26, 2017, STONE testified before the House Permanent Select 
Committee on Intelligence (HPSCI). Although the hearing was closed, STONE released to the 
public what he said were his opening remarks to the committee. In them, STONE stated: 


Members of this Committee have made three basic assertions against me which must be 
rebutted here today. The charge that I knew in advance about, and predicted, the hacking 
of Clinton campaign chairman John Podesta’s email, that I had advanced knowledge of 
the source or actual content of the WikiLeaks disclosures regarding Hillary Clinton or 
that, my now public exchange with a persona that our intelligence agencies claim, but 
cannot prove, is a Russian asset, is anything but innocuous and are entirely false. Again, 
such assertions are conjecture, supposition, projection, and allegations but none of them 
are facts.... 


My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s 
time in the barrel. #CrookedHillary” must be examined in context. I posted this at a time 
that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump 
campaign over allegations regarding his business activities in Ukraine. I thought it 
manifestly unfair that John Podesta not be held to the same standard. Note, that my 
Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but 
does accurately predict that the Podesta brothers’ business activities in Russia with the 
oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, 
would come under public scrutiny. .. . 


[L]et me address the charge that I had advance knowledge of the timing, content and 
source of the WikiLeaks disclosures from the DNC. On June 12, 2016, WikiLeaks’ 
publisher Julian Assange[] announced that he was in possession of Clinton DNC emails. 
I learned this by reading it on Twitter. I asked a journalist who I knew had interviewed 
Assange to independently confirm this report, and he subsequently did. This journalist 
assured me that WikiLeaks would release this information in October and continued to 
assure me of this throughout the balance of August and all of September. This 
information proved to be correct. I have referred publicly to this journalist as an, 
“intermediary”, “go-between” and “mutual friend.” All of these monikers are equally 


| 
true. 


DZ 
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89. In a document dated March 26, 2018 titled “Minority Views,” Democratic 
members of HPSCI published excerpts from Stone’s September 2017 testimony before HPSCI. 
Those excerpts include the following: 

Q: Have any of your employees, associates, or individuals acting on your behest or 

encouragement been in any type of contact with Julian Assange? 

MR. STONE: No. 

Q: So throughout the many months in which you represented you were either in 

communication with Assange or communication through an intermediary with Assange, 


you were only referring to a single fact that you had confirmed with the intermediary — 


MR. STONE: That — 
Q: -- was the length and the breadth of what you were referring to? 
MR. STONE: That is correct, even though it was repeated to me on numerous separate 


occasions. 


90. In the month that followed his testimony before HPSCI, on or about October 24, 
2017, STONE published an article on his website, stonecoldtruth.com, titled “Is it the Podesta’s 
Time in the Barrel Yet?” In that article, STONE stated: “[I]t was this inevitable scrutiny of the 
Podestas’ underhanded business dealings that my ‘time in the barrel’ referred to and not, as some 
have quite falsely claimed, to the hacking and publication almost two months later of John 
Podesta’s emails. ... [M]y tweet referred to Podesta’s business dealings with Russia, and the 
expectation that it would become a news story.” 

J. STONE’s Messaging to Randy CREDICO about STONE’s “Back channel” 

91. On or about November 19, 2017, Randy CREDICO (who, as described further 
below, STONE publicly identified as his “intermediary” to ASSANGE), messaged STONE, “My 
lawyer wants to see me today.” STONE responded, “‘Stonewall it. Plead the fifth. Anything to 
save the plan’........ Richard Nixon[.]” CREDICO responded, “Ha ha.” 

92. On or about November 21, 2017, CREDICO messaged STONE, “I was told that 


the house committee lawyer told my lawyer that I will be getting a subpoena[.]” STONE wrote 
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back, “That was the point at which your lawyers should have told them you would assert your 
5th Amendment rights if compelled to appear.” They continued to message, and CREDICO 
wrote, “My lawyer wants me to cut a deal.” STONE wrote back, “To do what ? Nothing 
happening in DC the day before Thanksgiving — why are u busting my chops?” 

93. On or about November 24, 2017, STONE, texted CREDICO, “Assange is a 
journalist and a damn good one- meeting with him is perfectly legal and all you ever told me was 
he had the goods [o]n Hillary and would publish them — which he himself said in public b4 u told 
me . It’s a fucking witchunt [sic].” CREDICO replied, “I told you to watch his tweets. That’s 
what I was basing it on. I told you to watch his Tweets in October not before that I knew nothing 
about the DNC stufff.] I just followed his tweets[.]” STONE responded, “U never said anything 
about the DNC but it was August.” CREDICO wrote back, “It was not August because I didn’t 
interview him or meet him until August 26th[.] That was my first communication with his 
secretary in London, August 26th.” STONE wrote back, “Not the way I remember it — oh well I 
guess Schiff will try to get one of us indicted for perjury[.]” 

94. | STONE and CREDICO continued to exchange messages and on November 24, 
2017, CREDICO wrote to STONE, “Forensic evidence proves that there is no back Channel. So 
now you can relax.” 

95. Onor about November 28, 2017, CREDICO tweeted a copy of a subpoena he 
received from HPSCI that was dated November 27, 2017. Toll records show that on November 
27 and 28, 2017, CREDICO and STONE communicated via text message more than a dozen 
times. 

96. On November 29, 2017, STONE publicly stated that CREDICO was his 


“intermediary.” In a public Facebook post, STONE further stated that “Credico merely [] 
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confirmed for Mr. Stone the accuracy of Julian Assange’s interview of June 12, 2016 with the 
British ITV network, where Assange said he had ‘e-mails related to Hillary Clinton which are 
pending publication,” . .. Credico never said he knew or had any information as to source or 
content of the material.” 

97. On or about December 1, 2017, CREDICO messaged STONE, “I don’t know why 
you had to lie and say you had a back Channel now I had to give all of my forensic evidence to 
the FBI today what a headache[.]* You could have just told him the truth that you didn’t have a 
back Channel they now know that I was not in London until September of this year[.] You had 
no back-channel and you could have just told the truth . . . You want me to cover you for perjury 
now].]” STONE responded, “What the fuck is your problem? Neither of us has done anything 
wrong or illegal. You got the best press of your life and you can get away with asserting for 5th 
Amendment rights if u don’t want talk about AND if you turned over anything to the FBI you’re 
a fool.” CREDICO responded, “You open yourself up to six counts of perjury[.] But I’m sure 
that wasn’t sworn testimony so you’re probably clear[.] Council for the committee knows you 
never had a back Channel and if you had just told the truth wouldn’t have put me in this bad spot 
... you should go back . . . and amend your testimony and tell them the truth.” CREDICO 
repeated: “you need to amend your testimony before I testify on the 15th.” STONE replied, “If 
you testify you’re a fool. Because of tromp [sic] I could never get away with a certain [sic] my 
Fifth Amendment rights but you can. I guarantee you you [sic] are the one who gets indicted for 


99 


perjury if you’re stupid enough to testify[.] 


4 Contrary to his statement, CREDICO had not at that time provided any forensic evidence to the 
FBI. 
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98. | STONE and CREDICO continued to message each other on or about December 1, 
2017. In response to STONE’s message about being “stupid enough to testify,” CREDICO told 
STONE: “Whatever you want to say I have solid forensic evidence.” STONE responded: “Get 
yourself a real lawyer instead of some liberal wimp who doesn’t know how to tell his guys to 
fuck off good night.” CREDICO then wrote: “Just tell them the truth and swallow your ego you 
never had a back Channel particularly on June 12th[.]” STONE responded: “You got nothing.” 

99, On or about December 13, 2017, according to public reporting, CREDICO 
indicated that he would not testify before HPSCI and would invoke his Fifth Amendment rights. 

100. STONE and CREDICO continued to exchange text messages, and on or about 
January 6, 2018, CREDICO indicated to STONE that he was having dinner with a reporter. 
STONE responded, “Hope u don’t fuck Up my efforts to get Assange a pardon[.]” CREDICO 
messaged STONE, “I have the email from his chief of staff August 25th 2016 responding to an 
email I sent to WikiLeaks website email address asking you would do my show[.] That was my 
initial contact.” 

101. On or about January 8, 2018, CREDICO messaged STONE, stating: “Embassy 
logs . . . + 17 other pieces of information prove that I did not have any conversations with 
Assange until September of last year.” 

102. CREDICO and STONE continued to message each other, and on or about January 
25, 2018, CREDICO wrote to STONE: “You lied to the house Intel committee . . . But you’ll get 
off because you’re friends with Trump so don’t worry. I have all the forensic evidence[.] I was 
not a ba[ck] Channel and I have all those emails from September of 2016 to prove it[.]” 

103. On or about April 13, 2018, news reports stated that CREDICO had shown 


reporters copies of email messages he had received from STONE in the prior few days that 
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stated, “You are a rat. You are a stoolie. You backstab your friends — run your mouth my 
lawyers are dying Rip you to shreds.” Another message stated, “I’m going to take that dog away 
from you,” referring to CREDICO’s therapy dog. CREDICO stated that it was “certainly scary . 
.. When you start bringing up my dog, you’re crossing the line[.]”? 

104. On or about May 25, 2018, CREDICO provided additional messages he stated 
were from STONE to another news agency.° In these messages, STONE, on April 9, 2018, 
stated: “I am so ready. Let’s get it on. Prepare to die[.]” In the article, CREDICO stated that he 
considered this email from STONE a threat. STONE stated in the article that CREDICO “told 
me he had terminal prostate cancer . . . It was sent in response to that. We talked about it too. 


He was depressed about it. Or was he lying.” The article noted that CREDICO stated he did not 


have prostate cancer and did not have any such discussion with STONE. 


K. The Target Accounts 


5 https://www.yahoo.com/news/comedian-randy-credico-says-trump-adviser-roger-stone- 


threatened-dog-135911370.html 
6 https://www.motherjones.com/politics/2018/05/roger-stone-to-associate-prepare-to-die/ 
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BACKGROUND CONCERNING GOOGLE 


117. In my training and experience, I have learned that Google provides a variety of on- 
line services, including electronic mail (“email”) access, to the public. Google allows subscribers 
to obtain email accounts at the domain name gmail.com, like the Target Accounts. Subscribers 
obtain an account by registering with Google. During the registration process, Google asks 
subscribers to provide basic personal information. Therefore, the computers of Google are likely 
to contain stored electronic communications (including retrieved and unretrieved email) for 
Google Mail subscribers and information concerning subscribers and their use of Google Mail 
services, such as account access information, email transaction information, and account 
application information. In my training and experience, such information may constitute evidence 
of the crimes under investigation because the information can be used to identify the account’s 
user or users. 

118. In my training and experience, email providers generally ask their subscribers to 
provide certain personal identifying information when registering for an email account. Such 
information can include the subscriber’s full name, physical address, telephone numbers and other 


identifiers, alternative email addresses, and, for paying subscribers, means and source of payment 


ee 
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(including any credit or bank account number). In my training and experience, such information 
may constitute evidence of the crimes under investigation because the information can be used to 
identify the account’s user or users. Based on my training and my experience, I know that, even if 
subscribers insert false information to conceal their identity, this information often provides clues 
to their identity, location, or illicit activities. 

119. In my training and experience, email providers typically retain certain transactional 
information about the creation and use of each account on their systems. This information can 
include the date on which the account was created, the length of service, records of log-in 
(i.e., session) times and durations, the types of service utilized, the status of the account (including 
whether the account is inactive or closed), the methods used to connect to the account (such as 
logging into the account via the provider’s website), and other log files that reflect usage of the 
account. In addition, email providers often have records of the IP address used to register the 
account and the IP addresses associated with particular logins to the account. Because every device 
that connects to the Internet must use an IP address, IP address information can help to identify 
which computers or other devices were used to access the email account. 

120. In my training and experience, in some cases, email account users will 
communicate directly with an email service provider about issues relating to the account, such as 
technical problems, billing inquiries, or complaints from other users. Email providers typically 
retain records about such communications, including records of contacts between the user and the 
provider’s support services, as well as records of any actions taken by the provider or user as a 
result of the communications. In my training and experience, such information may constitute 


evidence of the crimes under investigation because the information can be used to identify the 


account’s user or users. 
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121. This application seeks a warrant to search all responsive records and information 
under the control of Google, a provider subject to the jurisdiction of this court, regardless of where 
Google has chosen to store such information. The government intends to require the disclosure 
pursuant to the requested warrant of the contents of wire or electronic communications and any 
records or other information pertaining to the customers or subscribers if such communication, 
record, or other information is within Google’s possession, custody, or control, regardless of 
whether such communication, record, or other information is stored, held, or maintained outside 
the United States. 

122. As explained herein, information stored in connection with an email account may 
provide crucial evidence of the “who, what, why, when, where, and how” of the criminal conduct 
under investigation, thus enabling the United States to establish and prove each element or 
alternatively, to exclude the innocent from further suspicion. In my training and experience, the 
information stored in connection with an email account can indicate who has used or controlled 
the account. This “user attribution” evidence is analogous to the search for “indicia of occupancy” 
while executing a search warrant at a residence. For example, email communications, contacts 
lists, and images sent (and the data associated with the foregoing, such as date and time) may 
indicate who used or controlled the account at a relevant time. Further, information maintained by 
the email provider can show how and when the account was accessed or used. For example, as 
described below, email providers typically log the Internet Protocol (IP) addresses from which 
users access the email account, along with the time and date of that access. By determining the 
physical location associated with the logged IP addresses, investigators can understand the 
chronological and geographic context of the email account access and use relating to the crime 


under investigation. This geographic and timeline information may tend to either inculpate or 
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exculpate the account owner. Additionally, information stored at the user’s account may further 
indicate the geographic location of the account user at a particular time (e.g., location information 
integrated into an image or video sent via email). Last, stored electronic data may provide relevant 
insight into the email account owner’s state of mind as it relates to the offense under investigation. 
For example, information in the email account may indicate the owner’s motive and intent to 
commit a crime (e.g.,communications relating to the crime), or consciousness of guilt 
(e.g., deleting communications in an effort to conceal them from law enforcement). 
FILTER REVIEW PROCEDURES 

123. Review of the items described in Attachment A and Attachment B will be 
conducted pursuant to established procedures designed to collect evidence in a manner consistent 
with professional responsibility requirements concerning the maintenance of attorney-client and 
other operative privileges. The procedures include use, if necessary, of a designated “filter 
team,” separate and apart from the investigative team, in order to address potential privileges. 

CONCLUSION 
124. Based on the forgoing, I request that the Court issue the proposed search warrant. 
125. Pursuant to 18 U.S.C. § 2703(g), the presence of a law enforcement officer is not 


required for the service or execution of this warrant. 
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REQUEST FOR SEALING 
126. I further request that the Court order that all papers in support of this application, 
including the affidavit and search warrant, be sealed until further order of the Court. These 
documents discuss an ongoing criminal investigation, the full nature and extent of which is not 
known to all of the targets of the investigation. Accordingly, there is good cause to seal these 
documents because their premature disclosure may seriously jeopardize that investigation. 


Respectfully submitted, 


[PARAR 


Patrick J. Myers 
Special Agent 
Federal Bureau of Investigation 


Subscribed and sworn to before me on this 2 Akay of October, 2018. 


r gA tent 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 
Property to be Searched 
This warrant applies to information associated with the Google accounts registered to the 
following email addresses, which are stored at premises owned, maintained, controlled, or 


operated by Google, LLC (“Google”), a company headquartered in Mountain View, California: 
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ATTACHMENT B 


I. Information to be disclosed by Google 


To the extent that the information described in Attachment A is within the possession, 


custody, or control of Google, LLC (“Google”), including any messages, records, files, logs, or 


information that have been deleted but are still available to Google, or have been preserved 


pursuant to a request made under 18 U.S.C. § 2703(f), Google is required to disclose the following 


information to the government for each account listed in Attachment A: 


a. 


The contents of all emails associated with the account, including stored or preserved 
copies of emails sent to and from the account, draft emails, the source and 
destination addresses associated with each email, the date and time at which each 
email was sent, and the size and length of each email; 

All records or other information regarding the identification of the account, to 
include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number); 

The types of service utilized; 

All records or other information stored at any time by an individual using the 
account, including address books, contact and buddy lists, calendar data, pictures, 


and files; 
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€. All records pertaining to communications between the Provider and any person 
regarding the account, including contacts with support services and records of 


actions taken; 


f. All subscriber “change history” associated with the account; 

g. All search history and web history associated with the account; 

h. All location and maps information associated with the account; 

i. All Google Analytics information associated with the account (including all 


properties and UA codes associated with the account, and, for each of these 


proprieties and UA codes, all usernames and email accounts associated with them); 


j. All Google Developers Console information associated with the account; 
k. All Minutemaid information associated with the account; 

L All Android information associated with the account; 

m. All Google Docs associated with the account; 

n. All YouTube information associated with the account; 

o. All Google Hangouts information associated with the account; 

p. All Google Voice information associated with the account; 


q All Web & App Activity associated with the account; 


r. All Google Drive information associated with the account; 
S. All Google+ information associated with the account; 
t: All device information associated with the account, including all instrument or 


telephone numbers (including MAC addresses, Electronic Serial Numbers 
(“ESN”), Mobile Electronic Identity Numbers (“MEIN”), Mobile Equipment 


Identifier (“MEID”), Mobile Identification Numbers (“MIN”), Subscriber Identity 
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Modules (“SIM”), Mobile Subscriber Integrated Services Digital Network Number 
(“MSISDN”), International Mobile Subscriber Identifiers (“IMSI”), or 
International Mobile Equipment Identities “IMEI’)); and 
u. For any accounts linked to the accounts listed in Attachment A, including accounts 
linked by cookie, SMS number, or recovery email address, and for accounts for 
which the accounts described in Attachment A are the recovery email address, 
provide all records or other information regarding the identification of the account, 
to include full name, physical address, telephone numbers and other identifiers, 
records of session times and durations, the date on which the account was created, 
the length of service, the IP address used to register the account, log-in IP addresses 
associated with session times and dates, account status, alternative email addresses 
provided during registration, methods of connecting, log files, and means and 
source of payment (including any credit or bank account number). 
II. Information to be Seized by the Government 
Any and all records that relate in any way to the accounts described in Attachment A 
which consists of evidence, fruits, or instrumentalities of violations of 18 U.S.C. § 2 (aiding and 
abetting), 18 U.S.C. § 3 (accessory after the fact), 18 U.S.C. § 4 (misprision of a felony), 18 
U.S.C. § 371 (conspiracy), 18 U.S.C. § 1001 (false statements), 18 U.S.C. § 1030 (unauthorized 
access of a protected computer); 18 U.S.C. §§ 1505 and 1512 (obstruction of justice), 18 U.S.C. 
§ 1513 (witness tampering), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1349 (attempt and 
conspiracy to commit wire fraud), and 52 U.S.C. § 30121 (foreign contributions ban) for the 


period from March 1, 2016 to the present, including: 


oA 


Case 1:19-mc-00029-CRC Document 29-30 Filed 04/28/20 Page 51 of 60 


a. All records, information, documents or tangible materials that relate in any way to 
communications regarding hacking, release of hacked material, communications 
with persons or entities associated with WikiLeaks, including but not limited to 
Julian Assange, or communications regarding disinformation, denial, dissembling 
or other obfuscation about knowledge of, or access to, hacked material; 

b. All records, information, documents or tangible materials that relate in any way to 
communications or meetings involving Jerome Corsi, Theodore Malloch, Julian 
Assange, Mark Goldman, Mamadou Paye, Andrew Miller, Randy Credico, any 
individual associated with the Trump Campaign, any witness in the investigation; 

€. Communications, records, documents, and other files related to any expenditure, 
independent expenditure, or disbursement for an electioneering communication; 

d. Records of any funds or benefits disbursed by or offered on behalf of any foreign 
government, foreign officials, foreign entities, foreign persons, or foreign 
principals; 

e. All images, messages, communications, calendar entries, search terms, “address 
book” entries and contacts, including any and all preparatory steps taken in 
furtherance of the above-listed offenses; 

f. Communications, records, documents, and other files that reveal efforts by any 
person to conduct activities on behalf of, for the benefit of, or at the direction of 
any foreign government, foreign officials, foreign entities, foreign persons, or 


foreign principals; 
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g. Evidence indicating how and when the account was accessed or used, to determine 
the geographic and chronological context ofaccount access, use, and events relating 
to the crimes under investigation and to the account owner; 

h. Evidence indicating the account user’s state of mind as it relates to the crimes under 
investigation; 

i. The identity of the person(s) who created or used the account, including records 
that help reveal the whereabouts of such person(s); 

Js Credit card and other financial information, including but not limited to, bills and 
payment records evidencing ownership of the subject account; 

k. All images, messages and communications regarding wiping software, encryption 
or other methods to avoid detection by law enforcement; 

L The identity of any non-U.S. person(s)—including records that help reveal the 
whereabouts of the person(s)—who made any expenditure, independent 
expenditure, or disbursement for an electioneering communication; and 

m. The identity of any person(s)—including records that help reveal the whereabouts 
of the person(s)—who communicated with the account about any matters relating 
to activities conducted by on behalf of, for the benefit of, or at the direction of any 
foreign government, foreign officials, foreign entities, foreign persons, or foreign 
principals. 

n. Passwords and encryption keys, and other access information that may be necessary 
to access the account and other associated accounts; 

o. All existing printouts from original storage which concern the categories identified 


in subsection Il.a. 
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III. Review Protocols 


Review of the items described in Attachment A and Attachment B shall be conducted 
pursuant to established procedures designed to collect evidence in a manner consistent with 
professional responsibility requirements concerning the maintenance of attorney-client and other 
operative privileges. When appropriate, the procedures shall include use of a designated “filter 


team,” separate and apart from the investigative team, in order to address potential privileges. 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 


IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-02994 
INFORMATION ASSOCIATED WITH FOUR | Assigned To : Howell, Beryl A. 
ACCOUNTS STORED AT PREMISES Assign. Date : 10/5/2018 
CONTROLLED BY GOOGLE Description: USA v. SEALED 


MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND 
TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b 


The United States of America, moving by and through its undersigned counsel, respectfully 
moves the Court for an Order placing the above-captioned warrant and the application and affidavit 
in support thereof (collectively herein the “Warrant”) under seal, and precluding the provider from 
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non- 
disclosure, the proposed Order would direct Google, an electronic communication and/or remote 
computing services provider headquartered in Mountain View, California, not to notify any other 
person (except attorneys for Google for the purpose of receiving legal advice) of the existence or 
content of the Warrant for a period of one year or until further order of the Court. 


JURISDICTION AND LEGAL BACKGROUND 


l. The Court has the inherent power to seal court filings when appropriate, 
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing 
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the 
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present 
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of 
the Warrant. See Washington Post v. Robinson, 935 F.2d 282, 287-89 (D.C. Cir. 1991). 

2 In addition, this Court has jurisdiction to issue the requested order because it is “a 
court of competent jurisdiction” as defined by 18 U.S.C. § 2711. Specifically, the Court is a 


“district court of the United States . . . that — has jurisdiction over the offense being investigated.” 
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18 U.S.C. § 2711(3)(A)@). Acts or omissions in furtherance of the offense under investigation 
occurred within Washington, D.C. See 18 U.S.C. § 3237. 

3. Further, the Court has authority to require non-disclosure of the Warrant under 18 
U.S.C. § 2705(b). Google provides an “electronic communications service,” as defined in 18 
U.S.C. § 2510(15), and/or “remote computing service,” as defined in 18 U.S.C. § 2711(2). The 
Stored Communications Act (“SCA”), 18 U.S.C. §§ 2701-2712, governs how Google may be 
compelled to supply communications and other records using a subpoena, court order, or search 
warrant. Specifically, Section 2703(c)(2) authorizes the Government to obtain certain basic 
“subscriber information” using a subpoena, Section 2703(d) allows the Government to obtain other 
“non-content” information using a court order, and Section 2703(a)-(b)(1)(A) allows the 
Government to obtain contents of communications using a search warrant. See 18 U.S.C. § 2703. 

4, The SCA does not set forth any obligation for providers to notify subscribers about 
subpoenas, court orders, or search warrants under Section 2703. However, many have voluntarily 
adopted policies of notifying subscribers about such legal requests. Accordingly, when necessary, 
Section 2705(b) of the SCA enables the Government to obtain a court order to preclude such 
notification. In relevant part, Section 2705(b) provides as follows:! 

(b) Preclusion of notice to subject of governmental access. — A governmental 

entity acting under section 2703 . . . may apply to a court for an order commanding 

a provider of electronic communications service or remote computing service to 

whom a warrant, subpoena, or court order is directed, for such period as the court 

deems appropriate, not to notify any other person of the existence of the warrant, 

subpoena, or court order. The court shall enter such an order if it determines that 

there is reason to believe that notification of the existence of the warrant, subpoena, 

or court order will result in— 


(1) endangering the life or physical safety of an individual; 
(2) flight from prosecution; 


! Section 2705(b) contains additional requirements for legal process obtained pursuant to 18 U.S.C. 
§ 2703(b)(1)(B), but the Government does not seek to use the proposed Order for any legal process 
under that provision. 
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(3) destruction of or tampering with evidence; 

(4) intimidation of potential witnesses; or 

(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial. 
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear 
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the 


requisite showing about potential consequences of notification: 


The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there 
is reason to believe that notifying the customer or subscriber of the court order or 
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the 
court must enter an order commanding a service provider to delay notice to a 
customer for a period of time that the court determines is appropriate. Once the 
government makes the required showing under § 2705(b), the court is required to 
issue the non-disclosure order. 


In re Application for Order of Nondisclosure Pursuant to 18 U.S.C. § 2705(b) for Grand Jury 
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014). 

5: Accordingly, this motion to seal sets forth facts showing reasonable grounds to 
command Google not to notify any other person (except attorneys for Google for the purpose of 
receiving legal advice) of the existence of the Subpoena for a period of one year or until further 


order of the Court. 


FACTS SUPPORTING SEALING AND NON-DISCLOSURE 


6. The Federal Bureau of Investigation (“FBI”) is investigating violations of 18 U.S.C. 
§ 2 (aiding and abetting); 18 U.S.C. § 3 (accessory after the fact); 18 U.S.C. § 4 (misprision of a 
felony); 18 U.S.C. § 371 (conspiracy); 18 U.S.C. § 1030 (unauthorized access of a protected 
computer); 18 U.S.C. § 1343 (wire fraud); 18 U.S.C. § 1349 (attempt and conspiracy to commit 
wire fraud); and 52 U.S.C. § 30121 (foreign contribution ban) (the “Subject Offenses”), in 
connection with efforts to compromise the networks of the Democratic National Convention 
(“DNC”), the Democratic Congressional Campaign Committee (“DCCC”), and the email accounts 


of U.S. persons, followed by the public release of stolen materials through various outlets. 
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T. In this matter, the government requests that the Warrant be sealed until further order 
of the Court and that Google and its employees be directed not to notify any other person of the 
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal 
advice) for a period of one year or until further order of the Court. Such an order is appropriate 
because the Warrant relates to an ongoing criminal investigation, the scope and nature of which is 
neither public nor known to the targets of the investigation, and its disclosure may alert these 
targets to the nature, scope, and focus of the ongoing investigation. Disclosure of the Warrant and 
related papers may also alert the targets to the scope of information known to the FBI. Once alerted 
to this information, potential targets would be immediately prompted to destroy or conceal 
incriminating evidence, alter their operational tactics to avoid future detection, and otherwise take 
steps to undermine the investigation and avoid future prosecution. In particular, given that they 
are known to use electronic communication and remote computing services, the potential target 
could quickly and easily destroy or encrypt digital evidence relating to their criminal activity. 

8. Given the complex and sensitive nature of the criminal activity under investigation, 
and also given that the criminal scheme may be ongoing, the Government anticipates that this 
confidential investigation will continue for the next year or longer. However, should 
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no 
longer needed, the Government will notify the Court and seek appropriate relief. 

9, There is, therefore, reason to believe that notification of the existence of the 
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity 
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C. 


§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a 
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compelling governmental interest in confidentiality to justify the government’s sealing request. 
See Robinson, 935 F.2d at 287-89. 

10. Based on prior dealings with Google, the United States is aware that, absent a court 
order under Section 2705(b) commanding Google not to notify anyone about a legal request, 
Google may, upon receipt of a warrant seeking the contents of electronically stored wire or 
electronic communications for a certain account, notify the subscriber or customer of the existence 
of the warrant prior to producing the material sought. 

WHEREFORE, for all the foregoing reasons, the government respectfully requests that the 
above-captioned warrant, the application and affidavit in support thereof, and all attachments 
thereto and other related materials be placed under seal, and furthermore, that the Court command 
Google not to notify any other person of the existence or contents of the above-captioned warrant 
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year or 
until further order of the Court. 

Respectfully submitted, 


ROBERT S. MUELLER, II 


Dated: (0 /5/18 


(202) 616-3812 
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FILED 


OCT -5 2018 
IN THE UNITED STATES DISTRICT COURT 
tand 
FOR THE DISTRICT OF COLUMBIA Clerk US. Di Courts 
IN THE MATTER OF THE SEARCH OF Case: 1:18-sc-—02994 
INFORMATION ASSOCIATED WITH FOUR Assigned To : Howell, Beryl A. 
ACCOUNTS STORED AT PREMISES Assign. Date : 10/5/2018 
CONTROLLED BY GOOGLE Description: USA v. SEALED 


ORDER 

The United States has filed a motion to seal the above-captioned warrant and related 
documents, including the application and affidavit in support thereof (collectively the “Warrant”), 
and to require Google, an electronic communication and/or remote computing services provider 
headquartered in Mountain View, California, not to disclose the existence or contents of the 
Warrant pursuant to 18 U.S.C. § 2705(b). 

The Court finds that the United States has established that a compelling governmental 
interest exists to justify the requested sealing, and that there is reason to believe that notification 
of the existence of the Warrant will seriously jeopardize the investigation, including by giving the 
targets an opportunity to flee from prosecution, destroy or tamper with evidence, and intimidate 
witnesses. See 18 U.S.C. § 2705(b)(2)-(5). 

IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the 
warrant, the application and affidavit in support thereof, all attachments thereto and other related 


materials, the instant motion to seal, and this Order be SEALED until further order of the Court; 


and 
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IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its 
employees shall not disclose the existence or content of the Warrant to any other person (except 


attorneys for Google for the purpose of receiving legal advice) for a period of one year or until 


further order of the Court. 


THE vda igh Hac A. HOWELL 


CHIEF UNITED STATES DISTRICT JUDGE 


|b J W§ 


Date 
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AO 93 (Rev. 11/13) Search and Seizure Warrant 


EEE 
UNITED STATES DISTRICT COURT 


for the 
District of Columbia 


In the Matter of the Search of 
(Briefly describe the property to be searched 
or identify the person by name and address) 


VARIOUS ELECTRONIC DEVICES BELONGING TO 
ROGER J. STONE, JR. 


Case: 1:19-sw-00057 

Assigned To : Chief Judge Howell, Beryl A. 
Assign. Date : 2/13/2019 

Description: Search and Seizure Warrant 


SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the District of Columbia 
(identify the person or describe the property to be searched and give its location): 


See Attachment A. 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property 
described above, and that such search will reveal (identify the person or describe the property to be seized): 


See Attachment B. 


YOU ARE COMMANDED to execute this warrant on or before February 27, 2019 (not to exceed 14 days) 
@ in the daytime 6:00 a.m. to 10:00 p.m. (lat any time in the day or night because good cause has been established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the 
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the 
property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory 
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell 


(United States Magistrate Judge) 


Pursuant to 18 U.S.C. § 3103a(b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose 
property, will be searched or seized (check the appropriate box) 


O for days (not to exceed 30) C until, the facts justifying, the later specific date of — 


Date and time issued: Lliuag 12 A CF. af Y Gol Al LEZ. MAIE 


Judge's signature 


City and state: Washington, DC Hon. Beryl A-Howell, Chief U.S. District Judge 


Printed name and title 
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AO 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) 


Inventory made in the presence of : 


Inventory of the property taken and name of any person(s) seized: 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the 
designated judge. 


Executing officer's signature 


Printed name and title 
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ATTACHMENT A 
Property to be Searched 


The following devices provided to the FBI Jo o currently in the District of 


Columbia: 
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ATTACHMENT B 
Items to be seized from the Subject Devices 
ji The items to be seized are fruits, evidence, information relating to, contraband, or 
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of 
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for 
the time period June 2015 to the present, including: 
a. Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 
b. Documents reflecting communications between Stone and Jerome Corsi; 
c. Documents reflecting communications between Stone and Randy Credico; 
d. Documents reflecting communications between Stone and members of the Trump 
Campaign or Trump Campaign associates, including Steve Bannon, B 
Paul Manafort, Richard Gates, and Donald J. Trump; 
e. Documents related to or discussing the U.S. House of Representatives Permanent 
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or 


the Federal Bureau of Investigation; 


f. Records and information relating to the e-mail ae O j 
E 
g. Records and information relating to the WhatsApp account associated with 


telephone number 


h. Records and information relating to the Signal account associated with telephone 


number i’ 
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i. Records and information relating to the Wickr account associated with telephone 
mbes 

j. Any computers, media storage devices, tablets/iPads, cellular telephones, 
smartphones, personal data assistant devices, or other electronic devices used to 
commit the violations described above or to store records or documents described 
above; 

k. Records of personal and business activities relating to the operation and ownership 
of the computer systems, such as telephone records, notes, notebooks, diaries, and 
reference materials, in whatever form; 

l. Records pertaining to accounts held with Internet Service Providers or of Internet 
use, in whatever form; 

PA For any computer or storage medium whose seizure is otherwise authorized by this 
warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the things 
described in this warrant were created, edited, or deleted, such as logs, registry 
entries, configuration files, saved usernames and passwords, documents, browsing 
history, user profiles, email, email contacts, “chat,” instant messaging logs, 
photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 


software; 
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c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to determine 
the chronological context of computer access, use, and events relating to crime 
under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime under 
investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 

g. evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’s Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 
records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 


attachment. 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT FILE 
for the Pen 
District of Columbia 


„Clerk, U.3, Disirici a BanKrugey 
Gourts for the Metrict af fotumbreces 
In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


VARIOUS ELECTRONIC DEVICES BELONGING TO 
ROGER J. STONE, JR. 


Case: 1:19-sw-00057 

Assigned To : Chief Judge Howell, Beryl A. 
Assign. Date : 2/13/2019 

Description: Search and Seizure Warrant 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


See Attachment A 
located in the District of Columbia , there is now concealed (identify the 


person or describe the property to be seized): 


See Attachment B 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
Mf evidence of a crime; 
om contraband, fruits of crime, or other items illegally possessed; 
af property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. § 1505 Obstruction of Proceeding 
18 U.S.C. § 1512 Witness Tampering 
18 U.S.C. § 1001 False Statements 


The application is based on these facts: 
See attached Affidavit. 


Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. j 


Applicant’s signature 


Curtis Heide, Special Agent, FBI 


Printed name and title 


Reviewed by AUSA/SAUSA: 
[Aaron Zelinsky (ASC) 


Sworn to before me and signed in my presence. 


Date: 02/13/2019 be MaL 


udge’s signature 


City and state: Washington, D.C. Hon. Beryl A. Howell, Chief U.S. District Judge 


Printed name and title 
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IN THE UNITED STATES DISTRICT COURT poe U.S. Uisifiet & Bar 
FOR THE DISTRICT OF COLUMBIA ‘Cr me District of Ce 


~“IN THE MATTER OF THE SEARCH OF |. Gase; 1:19-sw-00057. — 
VARIOUS ELECTRONIC DEVICES Assigned To : Chief Judge Howell Beryl A 
BELONGING TO ROGER J. STONE, JR. Assign. Date : 2/13/2019 ; i 


Description: Search and Seizure Warrant 


AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows: 


INTRODUCTION AND AGENT BACKGROUND 


iA I make this affidavit in support of an application for a search warrant for the 
following devices (the “Subject Devices”) associated with Roger J. Stone, Jr. (“Roger Stone”), 
described below and further in Attachment A, currently located in the District of Columbia: 


a. 


b. 


Dis I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have 
been since 2006. In the course of my duties, I have been responsible for investigating federal 
crimes and national security matters involving both counterintelligence and issues related to 
cybersecurity. 

3. Iam currently involved in the investigation into Roger J. Stone, Jr., (“Roger Stone”) 
and others known and unknown to the government, for the commission of unlawful activities in 
the District of Columbia, and elsewhere, including, but not limited to: (i) obstruction of 


proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false statements, in 
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violation of Title 18, United States Code, Section 1001 and (iii) witness tampering, in violation of 
Title 18, United States Code 1512(b)(1) (collectively the “Specified Federal Offenses”). 

4, On January 24, 2019, a Grand Jury in the District of Columbia indicted Roger Stone 
on seven counts: (i) obstruction of proceeding, in violation of Title 18, United States Code, Section 
1505 (Count 1); (ii) false statements, in violation of Title 18, United States Code, Section 1001 
(Counts 2-6) and; (iii) witness tampering, in violation of Title 18, United States Code 1512(b)(1) 
(Count 7). See United States v. Roger Jason Stone, Jr., 19-cr-18-ABJ, Dkt. 1. On January 29, 
2019, Roger Stone pled not guilty to the charges before Magistrate Judge Deborah A. Robinson. 

5: I have personally participated in this investigation and am aware of the facts 
contained herein based on my own investigation, as well as my review of documents, records, and 
information provided to me by other law enforcement officers and technical experts. 

6. This affidavit is intended to show merely that there is sufficient probable cause for 
the requested warrant and does not set forth all of my knowledge about this matter. Unless 
specifically indicated, all conversations and statements in this affidavit are related in substance 
and part. Where I assert that an event took place on a particular date, I am asserting that it took 
place on or about the date specified. 

T. For the reasons set forth in this Affidavit, there is probable cause to believe that one 
or more of the Specified Federal Offenses have been committed by Roger Stone and others known 
and unknown to the government. Further, there is probable cause to believe that each of the Subject 
Devices have been used to facilitate the commission of one or more of the Specified Federal 
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and 
instrumentalities of violations of the Specified Federal Offense may be present in each of the 


Subject Devices, as described further in Attachment B. 
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PROBABLE CAUSE 
A. Background on Relevant Individuals 

8. Roger Stone is a political consultant who has worked for decades in U.S. politics 
and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of 
Donald J. Trump (“Trump Campaign”) until in or around August 2015, and subsequently 
maintained regular contact with and publicly supported the Trump Campaign through the 2016 
election. 

9. Julian Assange is the founder and director of WikiLeaks, which is publicly 
described as a non-profit organization that disseminates non-public information and classified 
media provided by anonymized sources. WikiLeaks has posted numerous documents stolen from 
the U.S. government. At all relevant times, Assange was located at the Ecuadorian Embassy in 
London, United Kingdom. 

10. Jerome Corsi is a political commentator who worked with an online media 
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi spoke regularly 
with Stone throughout the campaign, including about the release of stolen documents by 


WikiLeaks. 


12. Based on the investigation to date, Randy Credico was a radio host who has known 


Stone for more than a decade. In testimony before the U.S. House of Representatives Permanent 
Selection Committee on Intelligence (“HPSCI”) on or about September 26, 2017, Stone described 
Credico (without naming him) as an “intermediary,” “go-between,” and “mutual friend” to 


Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified Credico by 
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name and claimed Credico was the “gentleman who confirmed for Mr. Stone” that Assange, had 
“‘Te}mails related to Hillary Clinton which are pending publication.” 

13. Richard Gates is a U.S. citizen who served for years as a political consultant and 
lobbyist along with Paul Manafort. From in or around June 2016 until November 2016, Gates 
served as the deputy campaign chairman of the Trump Campaign. On February 23, 2018, Gates 
pled guilty to one count of conspiracy against the United States and one count of making false 
statements to federal law enforcement officers. United States v. Gates, 1:17-cr-201 (D.D.C.). 

14. Steve Bannon is a U.S. citizen who serves as a political consultant. Beginning in 


or around August 2016 and through the 2016 U.S. presidential election, Bannon served as the chief 


executive officer of the Trump Campaign. 


B. Hacking Activity During the 2016 Presidential Election 
16. John Podesta is a U.S. citizen who served for years as a political consultant. During 
the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the Hillary 
Clinton presidential campaign (“Clinton Campaign”). On or about March 24, 2016, Podesta 
received a spearphishing' email designed to appear as a security notification (a partial copy of the 
email was recovered by the FBI from a subsequent release of stolen emails, described below). 


During an interview with the FBI in or around May 2018, Podesta indicated that after receiving 


' In my training and experience, spearphishing in this context refers to the fraudulent practice of 
sending an email that purports to be from a known or trusted sender in order to induce the 
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL. 
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the email, his assistant (who also had access to the account) clicked on a link within the email and 
entered the account password when prompted (believing this prompt to be part of a security 
protocol). Based on my training and experience, this activity appears to have been a successful 
spearphishing operation, through which an actor would have gained access to Podesta’s email 
account, allowing the actor to steal emails and documents from that account. 

17. The Democratic National Committee (“DNC”) and Democratic Congressional 
Campaign Committee (“DCCC”) are U.S. political committees focusing on U.S. federal elections. 
Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including the 2016 
U.S. presidential election. According to DNC and DCCC individuals interviewed by the Special 
Counsel’s Office, in or around the spring of 2016, the DNC and DCCC became aware that their 
computer systems had been compromised by unauthorized intrusions and hired the cybersecurity 
company CrowdStrike to investigate the intrusions and remediate. 

18. On or about June 14, 2016, CrowdStrike issued a public press release announcing 
that the DNC’s computer network had been compromised. In the public statement, CrowdStrike 
indicated that it had identified “two sophisticated adversaries on the network,” which it referred to 
by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously 
seen these actors target other customers and that, based on their experience, “[b]oth adversaries 
engage in extensive political and economic espionage for the benefit of the government of the 
Russian Federation and are believed to be closely linked to the Russian government’s powerful 
and highly capable intelligence services.” 

19. On or about July 13, 2018, a federal grand jury sitting in the District of Columbia 
returned an indictment against eleven Russian nationals, charging them with partaking in a 


conspiracy to hack into, among other things, the email account of John Podesta, as well as the 
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DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1:18-cr-215 
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in the 
Main Intelligence Directorate of the General Staff (“GRU”), the Russian Federation’s military 
intelligence agency. 

C. WikiLeaks’ Release of Stolen Documents During the 2016 Presidential Campaign 

20. As alleged in the Netyksho indictment, after successfully hacking the DNC and 
DCCC networks, as well as Podesta’s email account, GRU officers transmitted some of the stolen 
documents to WikiLeaks. GRU officers communicated with WikiLeaks members about the 
transfers using online personas created by the GRU, including “Guccifer 2.0” and “DCLeaks.” 
(GRU officers separately used these personas to release some of the stolen documents). 

21. On or about July 22, 2016, WikiLeaks released tens of thousands of documents 
stolen from the DNC network. These stolen documents included communications by senior DNC 
officials about campaign strategy, financial and fundraising data, and other documents related to 
the 2016 U.S. federal elections, including the 2016 U.S. presidential election. 

22. Beginning in or around October 2016, WikiLeaks began to release tens of 
thousands of emails and documents stolen from Podesta’s email account. Between on or about 
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of 
documents that had been stolen from John Podesta, releasing a total of over 50,000 documents. 

D. Stone’s Communications About WikiLeaks During the Campaign 

23. In April 2018 interviews with the Special Counsel’s Office, Richard Gates stated 
that starting in or around May 2016, when Gates was a senior official on the Trump campaign, 
Stone informed members of the Trump Campaign that WikiLeaks had emails from then-candidate 


Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by 
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WikiLeaks, Gates observed a conversation between Manafort and Stone in which they discussed 
WikiLeaks and Stone’s prediction of the release. 

24. According to Gates, Manafort directed Gates to contact Stone about any additional 
releases and what other information WikiLeaks had regarding the Clinton Campaign. Gates 
contacted Stone, who made statements claiming that there would be potential future releases of 
damaging material by WikiLeaks. In a separate interview with the Special Counsel’s Office in or 
around October 2018, Gates recalled that at one point during the campaign he was with then- 
candidate Trump in a car when the candidate had a telephone call with Stone; shortly after finishing 
the call with Stone, Gates recalled then-candidate Trump said more leaks were coming. 

25. Emails recovered through a court-authorized search of Stone’s email account 

See show that shortly after the July 22, 2016 release of stolen DNC emails 
by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to 
obtain other emails damaging to the Clinton Campaign: 

a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject 
line, “Get to Assange.” The body of the message read, “Get to Assange [alt 
Ecuadorian Embassy in London and get the pending WikiLeaks emails . . . they 


deal with Foundation, allegedly.” On or about the same day, Corsi forwarded 


2 A search of C.. authorized on or about September 11, 2017 by the U.S. 
District Court for the District of Columbia. Case No. 1:17-mj-661 (D.D.C. Sept. 11, 2017). A 


second search of was authorized on or about August 3, 2018 by the U.S. 
District Court for the District of Columbia. Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). On or 
about September 26, 2018, the government obtained and executed an order pursuant to 18 U.S.C. 
§ 2703(d) for records connected t Case No. 1:18-sc-2911 (D.D.C. Sept. 
26, 2018). Records provided in response by Microsoft Corporation confirmed that the account 
was still active and that the relevant emails described in this affidavit were not deleted from the 
account. 
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Stone’s email to a... lived in the United Kingdom and who was a 
supporter of the Trump Campaign. 

b. On or about July 31, 2016, Stone emailed Corsi with the subject line, “Call me 
MON.” The body of the email read in part that | ae see Assange.” 

c. On or about August 2, 2016, Corsi responded to Stone by email and wrote that he 
was currently in Europe and planned to return in mid-August. Corsi stated, “Word 
is friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in Oct. 
Impact planned to be very damaging.” In a law enforcement interview, Corsi stated 
that the phrase “friend in embassy” referred to Assange. Corsi added in the same 
email, “Time to let more than Podesta to be exposed as in bed w enemy if they are 
not ready to drop HRC. That appears to be the game hackers are now about. Would 
not hurt to start suggesting HRC old, memory bad, has stroke — neither he nor she 
well. I expect that much of next dump focus, setting stage for Foundation debacle.” 

26. According to recorded public statements recovered by the FBI, starting in early 
August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated 
statements about information he claimed to have learned from Assange: 

a. According to a public video posted to YouTube, on or about August 8, 2016, Stone 
attended a public event in Broward County, Florida. During the event, Stone stated, 
“I actually have communicated with Assange. I believe the next tranche of his 
documents pertain to the Clinton Foundation, but there’s no telling what the 
October surprise may be.” 

b. According to a public video posted to YouTube, on or about August 12, 2016, Stone 


was interviewed for a video segment on the show InfoWars, hosted by Alex Jones. 
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During the interview, Stone stated that he was “in communication with Assange” 
but was “not at liberty to discuss what I have.” 

c. According to a public video posted to YouTube, on or about August 16, 2016, Stone 
stated during another interview with Alex Jones that “it became known on this 
program that I have had some back-channel communications with WikiLeaks and 
Assange.” In a second interview on or about the same day with Dana Loesch of 
the TheBlaze TV, Stone stated that he “communicated with Mr. Assange” and that 
they had a “mutual acquaintance who is a fine gentleman.” 

d. According to a video posted to the public website of the TV station C-SPAN, during 
a C-SPAN television interview on or about August 18, 2016, Stone stated that he 
had communicated with Assange through an “intermediary, somebody who is a 
mutual friend.” 

e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio 
interview he did with Stone on or about August 23, 2016 during which the two 
discussed Stone’s prior claims to be in contact with Assange. At one point during 
the interview, Credico asked Stone, “You’ve been in touch indirectly with Assange. 
Can you give us any kind of insight? Is there an October surprise happening?” 
Stone responded, “Well, first of all, I don’t want to intimate in any way that I control 
or have influence with Assange because I do not.... We have a mutual friend, 
somebody we both trust and therefore I am a recipient of pretty good information.” 


27. In or around November 2018, i Stonc 


produced a series of text messages between Stone and Credico during the 2016 presidential 
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campaign.’ These text messages show that, beginning on or about August 19, 2016, Stone 
exchanged written communications with Credico about what WikiLeaks and Assange planned to 
do. Emails recovered through a court-authorized search of Stone’s email account 

0O additional written communications between Stone and Credico 
about WikiLeaks in or around September 2016. 

a. Onor about August 19, 2016, Credico sent a text message to Stone that read in part, 
“I’m going to have Julian Assange on my show next Thursday.” On or about 
August 21, 2016, Credico sent another text message to Stone, writing in part, “I 
have Julian Assange on Thursday so I’m completely tied up on that day.” 

b. Onor about August 25, 2016, Assange was a guest on Credico’s radio show for the 
first time. On or about August 26, 2016, Credico sent a text message to Stone that 
stated, “Assange talk[ed] about you last night.” Stone replied and asked what 
Assange said, to which Credico responded, “He didn’t say anything bad we were 
talking about how the Press is trying to make it look like you and he are in cahoots.” 

c. On or about August 27, 2016, Credico sent text messages to Stone that said, “We 
are working on a Julian Assange radio show,” and that he (Credico) was “in charge” 
of the project. In a text message sent later that day, Credico added, “Julian Assange 
has kryptonite on Hillary.” 


d. Onor about September 18, 2016, Stone sent a text message to Credico that said, “I 


am e-mailing u a request to pass on to assange.” Credico responded “Ok,” and 


3 As discussed below, Stone had previously released some of these text messages to members of 
the media, who had written about them and published them in part. 
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added in a later text message, “Just remember do not name me as your connection 
to Assange you had one before that you referred to.” 

e. Later on or about September 18, 2016, Stone emailed Credico an article with 
allegations against then-candidate Clinton related to her service as Secretary of 
State. Stone stated, “Please ask Assange for any State or HRC e-mail from August 
10 to August 30 -- particularly on August 20, 2011 that mention [the subject of the 
article] or confirm this narrative.” 

f. On or about September 19, 2016, Stone texted Credico again, writing, “Pass my 
message . . . to Assange.” Credico responded, “I did.” On or about September 20, 
2016, Credico forwarded the request to a close friend who was an attorney with the 
ability to contact the Assange. Credico blind-copied Stone on the forwarded email. 

g. Onor about September 30, 2016, Credico sent Stone via text message a photograph 
of Credico standing outside the Ecuadorian Embassy in London where Assange 
was located. 

h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text 
messages that stated, “big news Wednesday . . . now pretend u don’t know me... 
Hillary’s campaign will die this week.” In the days preceding these messages, the 
press had reported that Assange planned to make a public announcement on or 
about Tuesday, October 4, 2016, which was reported to be the 10-year anniversary 


of the founding of WikiLeaks. 
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28. 


On or about October 2, 2016, Stone emailed Credico, with the subject line “WTF?” 
and a link to an article at the website http://heatst.com/politics/october-surprise- 
thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement-due-to- 
security-concerns. Credico responded to Stone, “head fake.” 

On or about Monday, October 3, 2016, Stone wrote Credico and asked, “Did 
Assange back off.” Credico initially responded, “I can’t tal[k] about it.” After 
further exchanges with Stone, Credico responded, “I think it[’]s on for tomorrow.” 
Credico added, “Off the Record Hillary and her people are doing a full-court press 
they [sic] keep Assange from making the next dump . . . That’s all I can tell you on 
this line .. . Please leave my name out of it.” 


Emails and text messages recovered by the FBI show that, in or around October 


2016, Stone made statements about Assange’s future releases that were similar to prior statements 


made by Credico to him. For example: 


a. 


4 A search of 
District Court 
second search 
District Court 


In a court-authorized search of Stone’s email sccount ë g 


FBI recovered an email from Stone to E... on or about October 3, 2016, 
which stated in part, “Spoke to my friend in London last night. The payload is still 


coming.” 


In a court-authorized search of 0o :. FBI also recovered an 


email exchange from on or about October 3, 2016 between Stone and a reporter 


who had connections to Bannon. In the exchange, the reporter asked, “Assange — 


a authorized on or about October 17, 2017 by the U.S. 
or the District of Columbia. Case No. 1:17-mj-760 (D.D.C. Oct. 17, 2017). A 
of © A authorized on or about August 3, 2018 by the U.S. 
for the District of Columbia. Case No. 1:18-sc-2583 (D.D.C. Aug. 3, 201 8). 
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29. 


what’s he got? Hope it’s good.” Stone responded, “It is. I’d tell Bannon but he 
doesn’t call me back.” 

On or about October 4, 2016, Assange held a press conference but did not release 
any new materials pertaining to the Clinton Campaign. In a court-authorized search 
PF the FBI recovered an email exchange between Stone and 
Steve Bannon on or about October 4, 2016 that occurred after the press conference. 
In the exchange, Bannon asked, “What was that this morning???”, referring to 
Assange’s press conference. Stone responded, “Fear. Serious security concern. He 
thinks they are going to kill him and the London police are standing do[wn]. 


However — a load every week going forward.” 


. In a court-authorized search of Stone’s iCloud account,’ the FBI recovered text 


messages between Stone a from on or about October 4, 2016. In one text 
messace asked Stone if he had “hear[d] anymore from London.” Stone 
replied, “Yes — want to talk on a secure line — got Whatsapp.” In an interview with 
the Special Counsel’s Office in or around May wE confirmed that he and 
Stone spoke and that Stone had told him WikiLeaks had more material to release, 
and that the material was related to senior people associated with Clinton. 


On or about October 7, 2016, WikiLeaks released the first set of emails stolen from 


Podesta. According to text messages recovered from Stone’s iCloud account, shortly after the 


release, an associate of Bannon sent a text message to Stone that read “well done.” Similarly, 


5 A search of Stone’s iCloud account was authorized on or about March 14, 2018 by the U.S. 
District Court for the District of Columbia. Case No. 1:18-sc-662 (D.D.C. Mar. 14, 2018). The 
records for Stone’s iCloud account contained some, but not all, of Stone’s communications from 
the campaign period. 
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during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release, 
Stone said, “I told you this was coming.” 
E. Stone’s Communications with the House Permanent Select Committee on Intelligence 

30. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating 
allegations of Russian interference in the 2016 presidential election and possible links to 
individuals associated with political campaigns.° During a public HPSCI hearing on or about 
March 20, 2017, multiple HPSCI committee members indicated that Stone’s prior public 
statements about having communications with Assange (particularly those from August 2016) 
were of interest to the committee. 

31. Inor around May 2017, HPSCI sent a letter requesting that Stone voluntarily appear 
before the committee and produce relevant documents to HPSCI (a copy of the HPSCI letter was 
recovered by the FBI from a court-authorized search of Stone’s email account 
playersO2@gmail.com). The letter requested Stone produce: 

Any documents, records, electronically stored information 
including e-mail, communication, recordings, data and tangible 
things (including, but not limited to, graphs, charts, photographs, 
images and other documents) regardless of form, other than those 
widely available (e.g., newspaper articles) that reasonably could 
lead to the discovery of any facts within the investigation's publicly- 
announced parameters. 
32. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and 


stated that “Mr. Stone has no documents, records, or electronically stored information, regardless 


of form, other than those widely available that reasonably could lead to the discovery of any facts 


6 On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee 
on Intelligence (“SSCI’) announced the committee would conduct an inquiry that would 
investigate, among other things, any intelligence regarding links between Russia and individuals 
associated with political campaigns, as well as Russian cyber activity and other “active measures” 
directed against the United States in connection with the 2016 election. 
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within the investigation’s publicly-announced parameters.” (A copy of the letter was recovered 
from a court-authorized search of Stone’s email account a. 
F. Stone’s Testimony Before HPSCI 

33. On or about September 26, 2017, Stone provided HPSCI with an “opening 
statement” that his counsel requested be included as part of the record of proceedings before 
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice,’ Stone 
stated, “These hearings are largely based on a yet unproven allegation that the Russian state is 
responsible for the hacking of the DNC and John Podesta and the transfer of that information to 
WikiLeaks.” 

34. Also on or about September 26, 2017, Stone provided testimony in a closed session 
before HPSCI, at the U.S. Capitol in Washington, D.C. Stone’s testimony was transcribed, and a 
copy of the transcript was obtained by the Special Counsel’s Office from HPSCI in or around 
December 2018. Stone appeared before HPSCI under oath and affirmed for the record that he 
would tell the truth. At the beginning of the hearing, Stone was admonished that “it is unlawful to 
deliberately provide false information to Members of Congress or staff” and that “providing false 
information to this committee or concealing material information from this committee is a crime 
punishable by law.” 


Stone’s Testimony About Documents He Possessed Related to WikiLeaks 
35. During his HPSCI testimony, Stone was asked about HPSCI’s May 2017 document 


7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of 
Stone’s interview with HPSCI, as well as any written submissions and/or correspondence from 
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI 
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017 
interview of Roger Stone, a copy of Stone’s written opening statement, and various 
correspondence from Stone’s counsel to members of HPSCI. 
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request and whether Stone had any documents or written communications that discussed Julian 
Assange, Russian interference, or other relevant documents: 


Q: The committee wrote to you on May 9th requesting no later 
than May 22 any documents, records, electronically stored 
information, including email communication, recordings, 
data, and other tangible things relevant to our investigation. 
You wrote back through counsel that you had no documents, 
records, or electronically stored information regardless of 
form responsive to our requests. Was that a false statement? 


A: That is not a false statement. That’s what -- I believe that to 
be true. 

Leal 

Q: So you have no emails to anyone concerning the allegations 


of hacked documents or your conversations with the 
Guccifer 2[.0] or any discussions you have had with third 
parties about Julian Assange? You have no emails, no texts, 
no documents whatsoever, any kind of that nature? 


A: That is correct. Not to my knowledge. I think we met, again, 
the precise criteria of your request, and we complied. Again, 


if you have a more specific request, I'm happy to go back and 
look. ... 


Q: I just want to ask you under oath — 


We did an extensive search consistent with the direction of 
my attorneys, and we found nothing that met the criteria that 
you asked for. 


Q: I just want to be certain because you are under oath, where 
your letter was not under oath, that you have no documents, 
no emails, no texts, no tweets that refer to Julian Assange or 
Guccifer 2[.0] or Paul Manafort or the allegations 
concerning Russian connections with the campaign. You 
have had no discussions in any written form. You've written 
no documents yourself. 


A: In connection with Russian collusion, consistent with your 
exact and precise request, yes. 


36. In fact, and as described above, Stone had sent and received numerous emails and 
text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and 
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WikiLeaks possession of hacked emails. Court-authorized searches of Stone’s email accounts 
(including re and his iCloud account show that, 
at the time of his testimony, Stone was still in possession of many of these emails and text messages 
at the time he testified on or about September 22, 2017.8 These written communications included 
(a) Stone’s email to Corsi on or about July 25, 2016 that read in part, “Get to Assange [alt 
Ecuadorian Embassy in London and get the pending WikiLeaks emails... they deal with 
Foundation, allegedly.”; (b) Stone’s email to Corsi on or about July 31, 2016 that should 
see Assange”; (c) Corsi’s email to Stone on or about August 2, 2016 that stated in part, “Word is 
friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in Oct. Impact planned 
to be very damaging.”; (d) dozens of text messages and emails between Stone and Credico, 
beginning on or about August 19, 2016 and continuing through duration of the election, in which 
they discussed WikiLeaks and Assange; (e) Stone’s email to Jon or about October 3, 2016 
that read in part “Spoke to my friend in London last night. The payload is still coming.”; and (f) 
Stone’s email to Bannon on or about October 4, 2016 that claimed WikiLeaks would release “a 
load every week going forward.” 
Stone's Testimony About His Early August 2016 Statements 

oo During his HPSCI testimony on or about September 26, 2017, Stone was asked to 
explain his statements in early August 2016 about being in contact with Assange. Stone was 
specifically asked about his statement on or about August 8, 2016 that “I’ve actually 


8 The warrant for Stone’s email account [in was obtained on or about 


September 11, 2017 and executed shortly thereafter. Records provided in or around September 
2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the account 


was active and th j j ere not deleted from the account. The warrant for Stone’s 
email account i obtained on or about October 17, 2017 and executed 
shortly thereafter. The warrant for Stone’s iCloud account (which contained the text messages 
described above) was obtained on or about March 14, 2018 and executed shortly thereafter. 
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communicated with Assange,” as well as his statement on or about August 12, 2016 that he was 
“in communication with Assange” but was “not at liberty to discuss what I have.” 

38. Stone testified that these public references to having a means of contacting 
WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a “go- 
between, as an intermediary, as a mutual friend” of Assange. Stone declined to tell HPSCI the 
name of this “intermediary,” but he provided a description in his testimony that was largely 
consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to 
HPSCI that identified Credico by name as the “gentleman who confirmed for Mr. Stone” that 
Assange had “‘[e]mails related to Hillary Clinton which are pending publication.’”). 

39. In fact, documents recovered during the investigation (including those obtained via 
search warrant returns RR show that Stone did not begin communicating 
with Credico about Assange or WikiLeaks until on or about August 19, 2016°—approximately 
eleven days after Stone first claimed on or about August 8, 2016 to “actually have communicated 
with Assange” and a week after his August 12, 2016 statements of being “in communication with 
Assange” and “not at liberty to discuss what I have.” 

40. When interviewed by the FBI, Credico stated that the first time he ever spoke with 
Assange was on or about August 25, 2016, when Credico interviewed Assange.'? Credico also 


provided the FBI with partially redacted emails that he claimed were between him and another 


? As described above, on or about August 19, 2016, Credico informed Stone by text message that 
Credico intended to interview Assange the following week. On or about August 25, 2016, Credico 
interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico texted 
Stone that “Assange has kryptonite on Hillary.” 


10 Credico was first interviewed by the FBI in or around August 2018. He has subsequently 


participated in multiple voluntary interviews 
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member of WikiLeaks from on or about August 25, 2016, in which the two discuss the technical 
logistics for the interview later that day. During the exchange, Credico offered biographical 
information about himself, apparently as a means of introduction. 

41. The FBI has not identified any communications between Stone and Credico from 
August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When interviewed 
by the FBI, Credico claimed he was never directed by Stone in August 2016 to contact WikiLeaks. 

42. In contrast, and as described above, the FBI has identified written communications 
prior to August 8, 2016 in which Stone directed Corsi—not Credico—to contact Assange. On or 
about July 25, 2016, for example, Stone wrote to Corsi, “Get to Assange [a]t Ecuadorian Embassy 
in London and get the pending WikiLeaks emails . . . they deal with Foundation, allegedly.” 
Similarly, on or about August 2, 2016, Corsi—not Credico—sent an email to Stone in which Corsi 
wrote that “[w]ord is friend in embassy plans 2 more dumps,” including one in October. These 
communications occurred days before Stone’s first public statement on or about August 8, 2016 
claiming to be in communication with Assange. However, at no time did Stone identify Corsi to 
HPSCI as another individual Stone contacted to serve as a “go-between,” “intermediary,” or other 
source for information from WikiLeaks. Similarly, Stone also never disclosed his written 
communications with Corsi to HPSCI when answering HPSCI’s questioning about the August 8, 
2016 and August 12, 2016 statements about being in communication with Assange. 

Stone's Testimony About Communications to Assange 

43. During his HPSCI testimony, Stone was asked, “Did you ask [the intermediary] to 

communicate anything else to Assange?” Stone responded, “I did not.” Stone was then asked, 


“Did you ask [the intermediary] to do anything on your own behalf?” Stone responded, “I did 


not.” 
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44, In fact, starting on or about September 18, 2016, Stone directed Credico to pass on 

a request to Assange for documents that Stone believed would be damaging to the Clinton 
Campaign. 

a. According to text messages ob tine ll on or about 

September 18, 2016, Stone sent a text message to Credico that said, “I am e-mailing 

u a request to pass on to Assange.” On or about the same day, Stone emailed 

Credico an article with allegations against then-candidate Clinton related to her 

service as Secretary of State. Stone added, “Please ask Assange for any State or 

HRC e-mail from August 10 to August 30 — particularly on August 20, 2011 that 

mention [the subject of the article] or confirm this narrative.” (A copy of this email 


was obtained through a search of Stone’s email account 


b. According to text messages obtained on or about 
September 19, 2016, Stone texted Credico again, writing “Pass my message . . . to 
Assange.” Credico responded, “I did.” An email obtained from the account 
pe shows that on or about September 20, 2016, Credico 
forwarded the request to an attorney who had the ability to contact Assange; 
Credico blind copied Stone on the same email. 
Stone's Testimony About Written Communications with Credico 
45. During his HPSCI testimony, Stone was asked repeatedly about his 
communications with the person he identified as his intermediary. Stone stated that he had never 
communicated with his intermediary in writing in any way. During one exchange, Stone claimed 
only to have spoken with the intermediary telephonically: 
Q: [H]ow did you communicate the intermediary? 


A: Over the phone. 
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Q: 
A: 


And did you have any other means of communicating with 
the intermediary? 


No. 
No text messages, no — none of the list, right? 


No. 


Later during his testimony, Stone again denied ever communicating with his intermediary in 


writing: 


A: 


O P Q È 


So you never communicated with your intermediary in 
writing in any way? 


No. 
Never emailed him or texted him? 
He’s not an email guy. 


So all your conversations with him were in person or over 
the phone. 


Correct. 


46. As described above, Stone and Credico (whom Stone identified as his intermediary) 


engaged in frequent written communication by email and text message. Beginning on or about 


August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone and Credico 


engaged in dozens of communications by email or text message in which they discussed 


WikiLeaks and the possible release of stolen documents that would be damaging to the Clinton 


Campaign. 


47. Written communications between Stone and Credico continued up until Stone’s 


HPSCI testimony and afterwards. For example, on or about September 26, 2017—the day that 


Stone testified before HPSCI and denied having ever sent or received emails or text messages from 


his identified intermediary—Stone and Credico exchanged over thirty text messages. 


48. Certain ofthe electronic messages between Stone and Credico (which Stone denied 
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ever taking place or possessing) would have been material to HPSCI, including Stone’s messages 
in or around September 2016 directing Credico to pass a request for documents to Assange, and 
other relevant written communications with Credico. For example, on or about January 6, 2017, 
Credico sent Stone an email, which Stone had in his possession at the time of his HPSCI testimony, 
that had the subject line “Back channel bs.” In the email, Credico wrote, “Well I have put together 
timelines[] and you [] said you have a back-channel way back a month before I had Assange on 
my show... I have never had a conversation with Julian Assange other than my radio show . . . I 
have pieced it all together . . . so you may as well tell the truth that you had no back-channel or 
there’s the guy you were talking about early August.” (A copy of this email was obtained through 
a search of Stone’s email accoun i 
Stone’s Testimony About Communications with the Trump Campaign 
49. During his HPSCI testimony, Stone was asked, “[d]id you discuss your 
conversations with the intermediary with anyone involved in the Trump campaign?” Stone 
answered, “I did not.” As described above, Stone spoke to multiple individuals involved in the 
Trump campaign about what he claimed to have learned from his intermediary to Assange, 
including the following: 
a. As described above, Gates confirmed to investigators that Stone spoke with senior 
Trump Campaign officials by telephone to inform them about materials possessed 
by Assange and the timing of future releases. 
b. According to text messages TE on or about October 
3, 2016, Stone wrote to B. “Spoke to my friend in London last night. The 


payload is still coming.” 
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c. As described above, on or about October 4, 2016, after receiving information from 
Credico about the delay in WikiLeaks’s release of stolen materials, Stone emailed 
Bannon that Assange had a “[s]erious security concern” but would release “a load 
every week going forward.” 
G. Stone’s Attempts to Influence Credico Regarding HPSCI and the FBI 

50. According to an email recovered through a court-authorized search of Stone’s email 
acco on or about October 19, 2017, Stone sent Credico an excerpt of 
his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his “intermediary” to 
Assange. As described below, Credico repeatedly told Stone that his letter was false and said he 
should correct his statement to HPSCI, but Stone did not do so. Stone then engaged in a prolonged 

effort to prevent Credico from contradicting Stone’s false statements to HPSCI. 
Si. In or around November 2017, Credico received a request from HPSCTI to testify 


voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted 


repeatedly with Stone. [i ee 


a. On or about November 19, 2017, Credico texted Stone that his lawyer wanted to 
see him. Stone responded, “‘Stonewall it. Plead the fifth. Anything to save the 
plan’ . . . Richard Nixon.” (A copy of these text messages was recovered through 
a court-authorized search of Stone’s iCloud account). On or about November 20, 
2017, Credico informed HPSCI that he declined HPSCI’s request for a voluntary 


interview. 
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b. On or about November 21, 2017, Credico texted Stone, “I was told that the house 
committee lawyer told my lawyer that I will be getting a subpoena.” Stone 
responded, “That was the point at which your lawyers should have told them you 
would assert your 5th Amendment rights if compelled to appear.” (A copy of these 
text messages was recovered through a court-authorized search of Stone’s iCloud 
account). 

c. On or about November 28, 2017, Credico received a subpoena compelling his 
testimony before HPSCI. Credico informed Stone of the subpoena. 

d. According to emails recovered from Stone’s email accoun 
on or about November 30, 2017, Stone asked Corsi to write publicly about Credico. 
Corsi responded, “Are you sure you want to make something out of this now? Why 
not wait to see what [Credico] does? You may be defending yourself too much — 
raising new questions that will fuel new inquiries. This may be a time to say less, 
not more.” Stone responded by telling Corsi that Credico “will take the Sth—but 
let’s hold a day.” 

e. According to text messages recovered from Stone’s iCloud account, on multiple 
occasions, starting on or about November 17, 2017, Stone and Credico discussed 
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part 
II, who falsely claims not to know critical information before a congressional 
committee that he does in fact know. On or about December 1, 2017, Stone told 
Credico in a text message to “Start practicing your Pentagele.” When interviewed 
by the FBI, Credico confirmed that he understood Stone’s references to Frank 


Pentangeli to be Stone’s way of suggesting Credico withhold relevant information 
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52. 


from investigators. 

On or about December 1, 2017, Stone texted Credico, “And if you turned over 
anything to the FBI you’re a fool.” Later that day, Credico texted Stone, “You need 
to amend your testimony before I testify on the 15th.” Stone responded, “If you 
testify you’re a fool. Because of tromp I could never get away with a certain [sic] 
my Fifth Amendment rights but you can. I guarantee you you are the one who gets 
indicted for perjury if you’re stupid enough to testify.” (A copy of these text 
messages was recovered through a court-authorized search of Stone’s iCloud 
account). 


On or about December 12, 2017, Credico informed HPSCI that he intended to assert 


his Fifth Amendment privilege against self-incrimination if required to appear by subpoena. 


According to Credico, he invoked his Fifth Amendment privilege in part to avoid providing 


evidence that would show Stone’s previous testimony to Congress was false. 


53. 


Following Credico’s invocation of his Fifth Amendment privilege not to testify 


before HPSCI, Stone and Credico continued to have discussions about the various investigations 


into Russian interference in the 2016 election and what information Credico would provide to 


investigators. During these conversations, Stone repeatedly made aggressive statements intended 


to prevent Credico from cooperating with the investigations. For example: 


a. 


On or about December 24, 2017, Credico texted Stone, “I met assange for f[i]rst 
time this yea[r] sept 7 . . . docs prove that . .. You should be honest w fbi. . . there 
was no back channel . . . be honest.” Stone replied approximately two minutes 


later, “I’m not talking to the FBI and if your smart you won’t either.” (A copy of 
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these text messages was recovered through a court-authorized search of Stone’s 
iCloud account). 

b. On or about April 9, 2018, Stone wrote in an email to Credico, “You are a rat. You 
are a stoolie. You backstab your friends—run your mouth my lawyers are dying 
Rip you to shreds.” Stone also said he would “take that dog away from you,” 
referring to Credico’s dog. On or about the same day, Stone wrote to Credico, “I 
am so ready. Let’s get it on. Prepare to die [expletive].” (A copy of this email 
exchange was recovered through a court-authorized search of Stone’s email 
c. Onor shout May 21, 2018, Credico wrote in an email to Stone, “You should have 
just been honest with the house Intel committee . . . you’ve opened yourself up to 
perjury charges like an idiot.” Stone responded, “You are so full of [expletive]. 
You got nothing. Keep running your mouth and Pll file a bar complaint against 
your friend [the attorney who had the ability to contact the head of Assange].” (A 
copy of this email exchange was recovered through a court-authorized search of 
Stone’s email accour i). Credico believed Stone knew that 

Credico was sensitive to having this friend’s name publicly disclosed. 
H. Missing Electronic Communications and Stone’s Use of Encrypted Communications 
54. As described above, the government has recovered the content of many of Stone’s 
electronic communications from summer and fall of 2016 (during the period of the U.S. 
presidential election) and afterward (during the period of pending congressional investigations into 


Russian interference in the U.S. election). However, the government is aware of the existence of 
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numerous other relevant electronic communications, the content of which it has not yet been able 
to recover. 

55. As described above, during his HPSCI testimony, Stone falsely denied having 
emailed or exchanged text messages with his “intermediary” (later identified by Stone as Randy 
Credico). In fact, emails and text messages recovered in this investigation show the two 
communicated frequently by email and text messages; court-authorized searches of Stone’s email 
and iCloud accounts confirm that Stone still had those communications at the time he testified in 
or around September 2017. In numerous communications, Stone and Credico discussed Julian 
Assange and WikiLeaks, as well as Stone’s suggestion that Credico was his intermediary to 
Assange. These communications appear relevant and responsive to HPSCI’s inquiry, but Stone 
never disclosed them. 

56. In addition to these emails and text messages in the FBI’s possession, the FBI has 
reviewed telephone billing records for Stone’s cellular telephone for the years 2016 and 2017, and 
they show text message communications whose content that the government to date has not been 
able to obtain. For example, these records indicate that Stone and Credico alone exchanged 
thousands of text messages (including over 1,500 text messages between the period November 
2016 and December 2017) the substance of which the government to date has not recovered or 
reviewed. The government has only recently obtained text messages between Stone and Credico 
during some period of the campaign in 2016 from Stone’s subpoena production, issued after media 
reports in November 2018 stated that Stone’s attorneys were able to extract text messages between 
Stone and Credico from a phone Stone stopped using in 2016. But the government does not have, 
for the same time period, many of Stone’s other text messages. The government seeks these text 


messages believing they may show additional evidence of (1) the falsity of Stone’s HPSCI 
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testimony concerning his communications with his “intermediary” and (2) efforts to corruptly 
persuade Credico not to cooperate with pending investigations. As discussed further below, the 
government has reason to believe that these messages may be located on the Subject Devices. 

57. Additionally, the FBI has interviewed multiple associates of Stone, who confirmed 
that Stone has used encrypted applications to communicate with others. Similarly, records 
obtained in this investigation indicate Stone uses multiple applications designed for encrypted 
communication, including (a) WhatsApp,'' (b) Signal,!* (c) Wickr,! and (d) ProtonMail.'4 To 
date, the FBI has not obtained any of Stone’s communications conducted through these 


applications. 


11 According to open sources, WhatsApp is an application that allows the user to send text 
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and 
stores its messages separately from those text messages used on a mobile device’s default message 
application. 


12 According to open sources, Signal is an encrypted communications application allowing the user 
to send one-to-one and group messages, which can include files, voice notes, images and videos, 
and make one-to-one voice and video calls. Signal uses standard cellular mobile numbers as 
identifiers, and uses end-to-end encryption to secure all communications to other Signal users. 
Signal also allows users to set timers to messages, after which the messages will be deleted from 
both the sender’s and the receivers’ devices. 


13 According to open sources, Wickr is an instant messaging application that allows users to 
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file 
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows 
users to set an expiration time for their encrypted communications. In addition to encrypting user 
data and conversations, Wickr claims that its application strips metadata from all content 
transmitted through the network. 


'4 According to open sources, ProtonMail is an end-to-end encrypted email service that uses client- 
side encryption to protect email contents and user data before they are sent to ProtonMail servers. 
According to its website, ProtonMail is run by Proton Technologies AG, a company based in the 
Canton of Geneva, and its servers are located at two locations in Switzerland, outside of US and 
EU jurisdiction. 
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58. 


According to records from Stone’s iCloud account, a copy of the WhatsApp 
application was downloaded to an iPhone registered to Stone on or about October 


5, 2016. As described above, on or about October 4, 2016, Stone suggested in an 


email G they “talk on a secure line” and proposed using WhatsApp. 


. According to records from Stone’s iCloud account, a copy of the Signal application 


was downloaded to an iPhone registered to Stone on or about August 18, 2016. 
Additionally, text messages recovered from Stone’s iCloud account revealed that 
on or about November 15, 2016, Stone sent an attorney with the ability to contact 
Julian Assange a link to download the Signal application.! Approximately fifteen 
minutes after sending the link, Stone texted the attorney, “I’m on signal just dial 
my number.” The attorney responded, “P11 call you.” 

According to records from Stone’s iCloud account, a copy of the ProtonMail 
application was downloaded to an iPad registered to Stone on or about August 18, 


2016. 


. According to records from Stone’s iCloud account, a copy of the Wickr application 


was downloaded to an iPhone registered to Stone on or about August 5, 2017. 


Based on my training and experience, electronic communications using encrypted 


applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the 


device used to send and receive those communications. Communications from those applications 


can be obtained by law enforcement by searching the device either manually or via a data 


extraction device (such as Cellebrite). Searches of the physical device can reveal messages, 


'S This attorney was a close friend of Credico’s and was the same friend Credico emailed on or 
about September 20, 2016 to pass along Stone’s request to Assange for emails connected to the 
allegations against then-candidate Clinton related to her service as Secretary of State. 
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including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and Wickr, 
that have not been backed up to cloud accounts (such as an iCloud account). Additionally, review 
of the device and the downloaded application can reveal other evidence of encrypted 
communications, such as call logs and contact lists. 

59. The FBI continues to seek evidence of Stone’s communications and contacts during 
the period of the 2016 U.S. presidential election and through the present. The FBI believes these 
communications may contain evidence of additional communications concerning Assange, 
WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign. Such 
communications could constitute additional evidence of Stone’s efforts to obstruct HPSCI’s 
investigation by showing additional contacts and communications about Assange and WikiLeaks 
that Stone failed to disclose. 

I. The Subject Devices 

60. In or around November 2018, media reports began to publish excerpts of text 
messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies 
of these text messages subsequently were obtained from Stone I). '° 
According to these news articles, Stone released these messages to the media outlets, which Stone 
claimed were extracted by his lawyers from “a cell phone he stopped using in 2016.” Based on 
these statements and described further below, your affiant believes the cell phone referenced in the 


article to be the iPhone 5s. 


16 See, e.g., “Bombshell Text Messages Support Roger Stone’s Claims About WikiLeaks 
Backchannel,” Daily Caller, Nov. 14, 2018, available at https://dailycaller.com/2018/11/14/roger- 
stone-wikileaks-randy-credico-mueller. 


as. Stone produced some text messages between Credico and 
im; the latest-in-time text message produced by Stone occurred on or about November 14, 2016. 
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61. On or about February 11, 2019, investigators, with the consent of Roger Stone’s 
attorneys, spoke with i a certified forensic examiner who stated he had been retained 
by Roger Stone’s attorneys. fo had been authorized by Stone’s attorneys to provide the 
Subject Devices to the FBI, although in providing the devices, Stone did not consent to their search. 
Stillman gave the Agents three devices: the iPhone 5s, the iPhone 7, and the external hard drive. 

62. ae produced documentation to investigators indicating that the iPhone 5s was 
associated with the phone number ending in J Stone’s cellular number as discussed above. 
The documentation also indicated thai had imaged the iPhone 5s on or about November 
10, 2018, several days before the article discussed above where Stone claimed to have released 
newly-uncovered messages with Credico. Toll records produced by AT&T pursuant to subpoena 
indicate that Stone used an iPhone 5s from at least on or about January 1, 2015 through on or about 
November 14, 2016. Therefore, it appears that the iPhone 5s was the device Stone was using 
through November 14, 2016 to communicate with individuals including Credico and Corsi. 

63. E= also produced documentation to investigators that the iPhone 7 he 
provided to investigators was associated with the same Stone phone number ending in J. As 
discussed above, toll records produced by AT&T pursuant to subpoena indicate that Stone used an 
iPhone 7 from at least on or about November 14, 2016 through on or about February 25, 2018. As 
described above, Stone communicated extensively with Credico during this time. Toll records 
also indicate Stone continued to communicate with Corsi during this time period using the x3034 


number. 


The government believes copies of later-in-time text messages from late 2016 and early 2017 could 
be located on another device, such as the iPhone 7, or on backup storage media. 
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64. | told investigators that the external hard drive contained forensic 


images of Stone’s computers. ME ated that the hard drive contained backups created by a 


separate company in September 2017 from Stone’s computers in both Florida and New York. 


According 3 g backups were created as “clone copies,” which are copies of Stone’s 
computer systems. | aS indicated that the drive contained a separate image ae 
created in March 2018 of Stone’s computer in Florida, as well as backup images of the iPhones 
discussed above. As explained further herein, there is reason to believe that these images contain 
communications made by Stone with Credico, Corsi, and others made during the relevant time 
period, even if such communications had previously been deleted. 

COMPUTERS, ELECTRONIC STORAGE, AND FORENSIC ANALYSIS 

65. As described herein and in Attachment B, this application seeks permission to 
search the Subject Devices. One form in which the records might be found is data stored on a 
device’s hard drive. Thus, the warrants applied for would authorize the search of electronic storage 
media. 

66. Probable cause. I submit that there is probable cause to believe those records will 
be stored on the Subject Devices (the term “computer” below refers to Subject Devices), for at 
least the following reasons: 

a. Based on my knowledge, training, and experience, I know that computer files or 
remnants of such files can be recovered months or even years after they have been 
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic 
files downloaded to a storage medium can be stored for years at little or no cost. 
Even when files have been deleted, they can be recovered months or years later 


using forensic tools. This is so because when a person “deletes” a file on a 
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67. 


computer, the data contained in the file does not actually disappear; rather, that data 
remains on the storage medium until it is overwritten by new data. 

Therefore, deleted files, or remnants of deleted files, may reside in free space or 
slack space—that is, in space on the storage medium that is not currently being used 
by an active file—for long periods of time before they are overwritten. In addition, 
a computer’s operating system may also keep a record of deleted data in a “swap” 
or “recovery” file. 

Wholly apart from user-generated files, computer storage media—in particular, 
computers’ internal hard drives—contain electronic evidence of how a computer 
has been used, what it has been used for, and who has used it. To give a few 
examples, this forensic evidence can take the form of operating system 
configurations, artifacts from operating system or application operation, file system 
data structures, and virtual memory “swap” or paging files. Computer users 
typically do not erase or delete this evidence, because special software is typically 
required for that task. However, it is technically possible to delete this information. 
Similarly, files that have been viewed via the Internet are sometimes automatically 
downloaded into a temporary Internet directory or “cache.” 


Forensic evidence. As further described in Attachment B, this application seeks 


permission to locate not only computer files that might serve as direct evidence of the crimes 


described on the warrant, but also for forensic electronic evidence that establishes how computers 


were used, the purpose of their use, who used them, and when. There is probable cause to believe 


that this forensic electronic evidence will be on the Subject Devices because: 
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a. 


Data on the storage medium can provide evidence of a file that was once on the 
storage medium but has since been deleted or edited, or of a deleted portion of a 
file (such as a paragraph that has been deleted from a word processing file). Virtual 
memory paging systems can leave traces of information on the storage medium that 
show what tasks and processes were recently active. Web browsers, e-mail 
programs, and chat programs store configuration information on the storage 
medium that can reveal information such as online nicknames and passwords. 
Operating systems can record additional information, such as the attachment of 
peripherals, the attachment of USB flash storage devices or other external storage 
media, and the times the computer was in use. Computer file systems can record 
information about the dates files were created and the sequence in which they were 
created, although this information can later be falsified. 

As explained herein, information stored within a computer and other electronic 
storage media may provide crucial evidence of the “who, what, why, when, where, 
and how” of the criminal conduct under investigation, thus enabling the United 
States to establish and prove each element or alternatively, to exclude the innocent ` 
from further suspicion. In my training and experience, information stored within a 
computer or storage media (e.g., registry information, communications, images and 
movies, transactional information, records of session times and durations, internet 
history, and anti-virus, spyware, and malware detection programs) can indicate who 
has used or controlled the computer or storage media. This “user attribution” 
evidence is analogous to the search for “indicia of occupancy” while executing a 


search warrant at a residence. The existence or absence of anti-virus, spyware, and 
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malware detection programs may indicate whether the computer was remotely 
accessed, thus inculpating or exculpating the computer owner. Further, computer 
and storage media activity can indicate how and when the computer or storage 
media was accessed or used. For example, as described herein, computers typically 
contains information that log: computer user account session times and durations, 
computer activity associated with user accounts, electronic storage media that 
connected with the computer, and the IP addresses through which the computer 
accessed networks and the internet. Such information allows investigators to 
understand the chronological context of computer or electronic storage media 
access, use, and events relating to the crime under investigation. Additionally, 
some information stored within a computer or electronic storage media may provide 
crucial evidence relating to the physical location of other evidence and the suspect. 
For example, images stored on a computer may both show a particular location and 
have geolocation information incorporated into its file data. Such file data typically 
also contains information indicating when the file or image was created. The 
existence of such image files, along with external device connection logs, may also 
indicate the presence of additional electronic storage media (e.g., a thumb drive). 
The geographic and timeline information described herein may either inculpate or 
exculpate the computer user. Last, information stored within a computer may 
provide relevant insight into the computer user’s state of mind as it relates to the 
offense under investigation. For example, information within the computer may 
indicate the owner’s motive and intent to commit a crime (e.g., internet searches 


indicating criminal planning), or consciousness of guilt (e.g., running a “wiping” 
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C. 


program to destroy evidence on the computer or password protecting/encrypting 
such evidence in an effort to conceal it from law enforcement). 

A person with appropriate familiarity with how a computer works can, after 
examining this forensic evidence in its proper context, draw conclusions about how 
computers were used, the purpose of their use, who used them, and when. 

The process of identifying the exact files, blocks, registry entries, logs, or other 
forms of forensic evidence on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. While it is possible to specify in advance 
the records to be sought, computer evidence is not always data that can be merely 
reviewed by a review team and passed along to investigators. Whether data stored 
on a computer is evidence may depend on other information stored on the computer 
and the application of knowledge about how a computer behaves. Therefore, 
contextual information necessary to understand other evidence also falls within the 
scope of the warrant. 

Further, in finding evidence of how a computer was used, the purpose of its use, 
who used it, and when, sometimes it is necessary to establish that a particular thing 
is not present on a storage medium. For example, the presence or absence of 
counter-forensic programs or anti-virus programs (and associated data) may be 


relevant to establishing the user’s intent. 
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FILTER REVIEW PROCEDURES 

Review of the items described in Attachment B will be conducted pursuant to established 
procedures designed to collect evidence in a manner consistent with professional responsibility 
requirements concerning the maintenance of attorney-client and other operative privileges. The 
procedures include use of a designated “filter team,” separate and apart from the investigative 
team, in order to address potential privileges. 

CONCLUSION 

68. Based on the foregoing, your affiant respectfully requests that this Court issue a 

search warrant for the Subject Devices, more particularly described in Attachment A authorizing 


the seizure of the items described in Attachment B. 


Respectfully submitted, 


oe a oe 


isA. Heide 
Special Agent 
Federal Bureau of Investigation 


Sworn and subscribed before me on this / rem of February, 2019. 


EY, A fi 


The Honorable Beryl A. Howell 
Chief United States District Judge 
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ATTACHMENT A 


Property to be Searched 


The following devices provided to the FBI by PY currently in the District of 


Columbia: 
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; 3 


ATTACHMENT B 


Items to be seized from the Subject Devices 


The items to be seized are fruits, evidence, information relating to, contraband, or 


instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of 


proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 


United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for 


the time period June 2015 to the present, including: 


a. 


Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 
Documents reflecting communications between Stone and Jerome Corsi; 
Documents reflecting communications between Stone and Randy Credico; 
Documents reflecting communications between Stone and members of the Trump 
Campaign or Trump Campaign associates, including Steve Bannon, BE 
Paul Manafort, Richard Gates, and Donald J. Trump; 

Documents related to or discussing the U.S. House of Representatives Permanent 
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or 


the Federal Bureau of Investigation; 


Records and information relating to the e-mail accounts 
and as 


Records and information relating to the WhatsApp account associated with 


telephone number Sq: 
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h. Records and information relating to the Signal account associated with telephone 


i. Records and information relating to the Wickr account associated with telephone 


j. Any computers, media storage devices, tablets/iPads, cellular telephones, 


smartphones, personal data assistant devices, or other electronic devices used to 
commit the violations described above or to store records or documents described 
above; 

k. Records of personal and business activities relating to the operation and ownership 
of the computer systems, such as telephone records, notes, notebooks, diaries, and 
reference materials, in whatever form; 

l. Records pertaining to accounts held with Internet Service Providers or of Internet 
use, in whatever form; 

2. For all of the devices listed in Attachment A (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the things 
described in this warrant were created, edited, or deleted, such as logs, registry 
entries, configuration files, saved usernames and passwords, documents, browsing 
history, user profiles, email, email contacts, “chat,” instant messaging logs, 
photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 


software; 
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c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to determine 
the chronological context of computer access, use, and events relating to crime 
under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime under 
investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 

g. evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’s Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 
records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 


attachment. 
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AO 93 (SDNY Rev. 01/17) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
Southern District of New York 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


cen 


Case No. 


SEARCH AND SEIZURE WARRANT 


To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Southern District of New York 
(identify the person or describe the property to be searched and give its location): 


See Attachment A 


The person or property to be searched, described above, is believed to conceal (identify the person or descr ibe the property 
to be seized): 


See Attachment A 


The search and seizure are related to violation(s) of (insert statutory citations): 
18 U.S.C. §§ 1001, 1505, 1512(b)(1) 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 
property. , 
YOU ARE COMMANDED to execute this warrant on or before 


February 6, 2019 


(not to exceed 14 days) 
inthe daytime 6:00 a.m. to 10 p.m. O at any time in the day or night as I find reasonable cause has been f 
established. | 
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or ie the’ copy: ae SER at the 
place where the property was taken. TAn E ; 


The officer executing this warrant, or an officer present during the execution. n't the warrant, rhust ‘prepare an | 
inventopy as required by law and promptly return this warrant and inventory to the Clerk ofthe Court. | 


Upon its return, this warrant and inventory should be filed under seal by fhe! Clerk of the Court “247 AE ars 


USM Initials 


O I find that immediate notification may have an adverse result listed in’ 18 p: S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whioge property, will be 
searched or seized (check the appropriate box) (for days (not to exceed 30). — mac Q 
Cuntil, the facts justifying, the later specific date g, 


Date and time issued: ies i9 10:50." P a 


Judge’s signature 


City and state: New York, NY Hon. Robert W. Lehrburger 


Printed name and title 
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AO 93 (SDNY Rev. 01/17) Search and Seizure Warrant (Page 2) 


Return 


Date and time warrant executed: Copy of warrant and inventory left with: 


| 
Inventory made in the presence of : 
| 
| 
| 
| 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant 
to the Court. 


Executing officer’s signature 


Printed name and title 
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ATTACHMENT A 
I. Premises to be Searched — Subject Premises 
The premises to be searched (the “Subject Premises”) are described as follows, and 


include all locked and closed containers found therein: 


The Subject Premises are particularly described as 


IL. Items to Be Seized 
A. Evidence, Fruits, and Instrumentalities of the Subject Offenses 


The items to be seized from the Subject Premises include the following evidence, fruits, 
and instrumentalities of violations of (i) Title 18, United States Code, Section 1505 (obstruction 
of proceedings before departments, agencies, and committees); (ii) Title 18, United States Code, 


Section 1001 (false statements); and (iii) Title 18, United States Code, Section 1512(b)(1) (witness 


tampering); (collectively the “Subject Offenses”), for the period June 2015 to the present, 


described as follows: 

a. Evidence concerning who occupies or owns the Subject Premises, including 
without limitation, utility and telephone bills, mail envelopes, addressed 
correspondence, diaries, statements, identification documents, address books, 
telephone directories, and keys; 

b. Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 


1 
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c. Documents that reflect communications between Roger Stone and Jerome Corsi 
that concern the Subject Offenses; 

d. Documents reflecting communications between Roger Stone and Randy Credico 
that concern the Subject Offenses; 

e. Documents reflecting communications between Roger Stone and members of the 
Trump Campaign or Trump Campaign associates, including Stephen K. Bannon, 

i A Paul Manafort, Richard Gates, and Donald J. Trump, that concern the 

Subject Offenses; 

f. Documents related to or discussing investigations into Russian interference in the 
2016 U.S. presidential election and related matters by the U.S. House of 
Representatives Permanent Select Committee on Intelligence; the U.S. Senate 
Select Committee on Intelligence; and/or the Federal Bureau of Investigation; 

g. Records and information relating to the use, ownership, or control of e-mail 


h. Records and information demonstrating who uses, owns, or controls the WhatsApp 


account associated with telephone moe ; 


i. Records and information demonstrating who. uses, owns, or controls the Signal 


account associated with telephone number i: 


j. Records and information demonstrating who uses, owns, or controls the Wickr 


account associated with telephone ToS o o 


k. Records pertaining to accounts held with Internet Service Providers providing 


service at or to the Subject Premises; 
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1. Computers and media storage devices, including tablets/iPads, and records or 
documents demonstrating who operates, owns, or controls such devices, such as 
telephone records, notes, notebooks, diaries, and reference materials, in whatever 


form; and 


m. Cellular telephones, smartphones, or personal data assistant devices, and records or - 


documents demonstrating who operates, owns, or controls such devices, such as 
telephone records, notes, notebooks, diaries, and reference materials, in whatever 
form. 


B. Search and Seizure of Electronically Stored Information 


The items to be seized from the Subject Premises also include any computer devices and 
storage media that may contain any electronically stored information falling within the categories 
set forth in Section II.A.a-k of this Attachment above, including, but not limited to, desktop and 
laptop computers, disk drives, modems, thumb drives, personal digital assistants, smart phones, 
digital cameras, and scanners. In lieu of seizing an such computer devices or storage media, this 
warrant also authorizes the copying of such devices or media for later review. 


The items to be seized from the Subject Premises also include: 


L. Any items or records needed to access the data stored on any seized or copied 
computer devices or storage media, including but not limited to any physical keys, encryption 
devices, or records of login credentials, passwords, private encryption keys, or similar information. 


2. Any items or records that may facilitate a forensic examination of the computer 
devices or storage media, including any hardware or software manuals or other information 
concerning the configuration of the seized or copied computer devices or storage media, 


3. Any evidence concerning the identities or locations of those persons with access to, 
control over, or ownership of the seized or copied computer devices or storage media. 


C. Review of ESI 


Following seizure of any computer devices and storage media and/or the creation of 
forensic image copies, law enforcement personnel (who may include, in addition to law 
enforcement officers and agents, attorneys for the government, attorney support staff, agency 
personnel assisting the government in this investigation, and outside technical experts under 
government control) are authorized to review the ESI contained therein for information 
responsive to the warrant. l 
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In conducting this review, law enforcement personnel may use various techniques to 
locate information responsive to the warrant, including, for example: 


e surveying various file “directories” and the individual files they contain (analogous to 
looking at the outside of a file cabinet for the markings it contains and opening a drawer 
believed to contain pertinent files); i 


e opening or cursorily reading the first few “pages” of such files in order to determine 
their precise contents; 


ə scanning storage areas to discover and possibly recover recently deleted files or 
deliberately hidden files; 


° performing key word searches through all electronic storage areas to determine whether 
occurrences of language contained in such storage areas exist that are intimately related 
to the subject matter of the investigation; and 


e reviewing metadata, system information, configuration files, registry data, and any 
other information reflecting how, when, and by whom the computer was used. 


Law enforcement personnel will make reasonable efforts to search only for files, 
documents, or other electronically stored information within the categories identified in Sections 
I.A.a-k and II.B of this Attachment. However, law enforcement personnel are authorized to 
conduct a complete review of all the ESI from seized devices or storage media if necessary to 
evaluate its contents and to locate all data responsive to the warrant. 
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AO 106 (SDNY Rev. 01/17) Application for a Search Warrant 


UNITED STATES DISTRICT COURT 


for the 
Southern District of New York 


„J QMAGS 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


See Attachment A 


APPLICATION FOR A SEARCH AND SEIZURE WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


he Premises Known and Deserbe< 2 Iii 


located in the Southern District of New York , there is now concealed (identify the 


person or describe the property to be seized): 


See Attached Affidavit and its Attachment A 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
W evidence of a crime; 
O contraband, fruits of crime, or other items illegally possessed; 
property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section(s) Offense Description(s) 
18 U.S.C. §§ 1001, 1505, False statements, witness tampering, obstruction of proceedings 
1512(b)(1) before departments, agencies, and committees 


The application is based on these facts: 
See Attached Affidavit and its Attachment A 
i Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


on signatur e 


VSAJ Mickey J J, Robinson. 
“Pr imed name and title y 


Sworn to before me and signed in my presence. 


me A RE 
Date: s/a jlois a é One g F c 


2 Ny, dee ipa : 


j ign Robert W. këhidutger 
Printed munne and title 


City and:state: New York, NY 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE SOUTHERN DISTRICT OF NEW YORK 


aa Da E i a a e a a SE a Ga Aa h B SR neces nH eee eee eS eeeeee een bese ode 


In the Matter of the Application of the United | TO BE FILED UNDER SEAL 
States Of America for a Search and Seizure ' 

Warrant for the Premises Known and Described: Agent Affidavit in Support of 

Application for Search and Seizure 

Warrant 


SOUTHERN DISTRICT OF NEW YORK: 


Mickey J. Robinson, being duly sworn, deposes says: 
I. Introduction 


A. Affiant 
1. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have 


been since September 2012. I successfully completed New Agent Training at Quantico, Virginia, 
where I received extensive instruction on criminal investigations. 

2. I make this affidavit in support of an application pursuant to Rule 41 of the Federal 
Rules of Criminal Procedure for a warrant to search the premises specified below (the “Subject 
Premises”) for, and to seize, the items and information described in Attachment A. This affidavit 
is based upon my personal knowledge; my review of documents and other evidence; my 
conversations with other law enforcement personnel; and my training, experience and advice 
received concerning the use of computers in criminal activity and the forensic analysis of 
electronically stored information (“ESI”). Because this affidavit is being submitted for the limited 
purpose of establishing probable cause, it does not include all the facts that I have learned during 
the course of my investigation. Where the contents of documents and the actions, statements, and 
conversations of others are reported herein, they are reported in substance and in part, except where 


otherwise indicated. 
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B. The Subject Premises 


3. The Subject Premises are particularly described as 


C. The Subject Offenses 


4, For the reasons detailed below, I believe that there is probable cause to believe that 
the Subject Premises contain evidence, fruits, and instrumentalities of violations of (i) Title 18, 
United States Code, Section 1505 (obstruction of ietie before departments, agencies, oa 
committees); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 


United States Code, Section 1512(b)(1) (witness tampering); (collectively the “Subject Offenses”). 


Ul. Probable Cause 
A. Probable Cause Regarding Commission of the Subject Offenses 


5. I have personally participated in this investigation and am aware of the facts 
contained herein based on my own investigation, as well as my review of documents, records, and 
information provided to me by other law enforcement officers and technical experts. 

6. This affidavit is intended to show merely that there g sufficient probable cause for 
the requested warrant and does not set forth all of my knowledge about this matter. Unless 
specifically indicated, all conversations and statements in this affidavit are related in substance 
and part. Where I assert that an sim took place on a particular date, I am asserting that it took 


place on or about the date specified. 
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Ts For the reasons set forth in this Affidavit, there is probable cause to believe that one 
or more of the Subject Offenses have been committed by Roger Jason Stone, Jr., (“Roger Stone”) 
and others known and unknown to the government. Further, there is probable cause to believe the 
Subject Premises have been used to facilitate the commission of one ot more of the Subject 
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and 
instrumentalities of violations of the Subject Offenses may be present in the Subject Premises. 


Background on Relevant Individuals 


8. Based on publicly available information and information obtained in the 
investigation, I know the following: 

a. Roger Stone is a political consultant who has worked for decades in U.S. politics 
and on U.S. political campaigns. Stone was an official on the U.S. presidential 
campaign of Donald J. Trump (“Trump Campaign”) until in or around August 
2015, and subsequently maintained regular contact with and publicly supported the 
Trump Campaign through the 2016 election. 

b. Julian Assange is the founder and director of WikiLeaks, which is publicly 
described as a non-profit organization that disseminates non-public information and 
classified media provided by anonymized sources. WikiLeaks has posted numerous 
documents stolen from the U.S. government. At all relevant times, Assange was 
located at the Ecuadorian Embassy in London, United Kingdom. 

c. Jerome Corsi is a political commentator who worked with an online media 
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi 
spoke regularly with Stone throughout the campaign, including about the release of 


stolen documents by WikiLeaks. 
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e. -Randy Credico was a radio host who has known Stone for more than a decade. In 


testimony before U.S. House of Representatives Permanent Select Committee on ! 
| 
Intelligence (“HPSCI”) on or about September 26, 2017, Stone described Credico | 


(without naming him) as an “intermediary,” “go-between,” and “mutual friend” to 


Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified 


Credico by name and claimed Credico was the “gentleman who confirmed for Mr. 


Stone” that Assange, had ““‘[e] mails related to Hillary Clinton which are pending 

publication.’” 

f. Richard Gates is a U.S. citizen who served for years as a political consultant and 
lobbyist along with Paul Manafort. From in or around June 2016 until November 


2016, Gates served as the deputy campaign chairman of the Trump Campaign. On 


February 23, 2018, Gates pled guilty to one count of conspiracy against the United 


States and one count of making false statements to federal law enforcement officers. 


United States v. Gates, 1:17-cr-201 (D.D.C.). 
g. Stephen K. Bannon isa U.S. citizen who serves as a political consultant. Beginning 


in or around August 2016 and through the 2016 U.S. presidential election, Bannon 


served as the chief executive officer of the Trump Campaign. 
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Hacking Activity During the 2016 Presidential Election 


9, John Podesta is a U.S. citizen who served for years as a political consultant. During 
the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the Hillary 
Clinton presidential campaign (“Clinton Campaign”). On or about March 24, 2016, Podesta 
received a spearphishing! email designed to appear as a security notification (a partial copy of the 
email was recovered by the FBI from a subsequent release of stolen emails, described below). 
During an interview with the FBI in or around May 2018, Podesta indicated that after receiving 
the email, his assistant (who also had access to the account) clicked on a link within the email and 
entered the ETE password when prompted (believing this prompt to be part of a security 
protocol). Based on my training and experience, this activity appears to have been a successful 
spearphishing operation through which an actor would have gained access to Podesta’s email 
secoaut allowing the actor to steal emails and documents from that account. 

10. The Democratic National Committee (“DNC”) and Democratic Congressional 
Campaign Committee (“DCCC”) are U.S. political committees focusing on U.S. federal elections. 
Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including the 2016 
U.S. presidential election. Abconding to DNC and DCCC individuals interviewed by the Special 
Counsel’s Office, in or around the spring of 2016, the DNC and DCCC became aware that their 
computer systems had been compromised by unauthorized intrusions and hired the cybersecurity - 


company CrowdStrike to investigate the intrusions and remediate. 


‘Tn my training and experience, spearphishing in this context refers to the fraudulent practice of 
sending an email that purports to be from a known or trusted sender in order to induce the 
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL. 
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11. Onor about June 14, 2016, CrowdStrike issued a public press release announcing 
that the DNC’s computer network had been compromised. In the public statement, CrowdStrike 
indicated that it had identified “two sophisticated adversaries on the network,” which it referred to 
by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously 
seen these actors target other customers and that, based on their experience, “(both adversaries 
engage in extensive political and economic espionage for the benefit of the pewter of the 
Russian Federation and are believed to be closely linked to the Russian government’s powerful 
and highly capable intelligence services.” 

12. Onor about July 13, 2018, a federal grand jury sitting in the District of Columbia 
returned an indictment against eleven Russian nationals, charging them with partaking in a 
conspiracy to hack into, among other things, the email account of John Podesta, as well as the 
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1:18-cr-215 
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in the 
Main Intelligence Directorate of the General Staff (“GRU”), the Russian Federation’s military 
intelligence agency. 


WikiLeaks’ Release of Stolen Documents During the 2016 Presidential Campaign 


13. As alleged in the Netyksho indictment, after successfully hacking the DNC and 
DCCC networks, as well as Podesta’s email account, GRU officers transmitted some of the stolen 
documents to WikiLeaks. GRU officers communicated with WikiLeaks members about the 
transfers using online personas created by the GRU, including “Guccifer 2.0” and “DCLeaks.” 
(GRU officers separately used these personas to release some of the stolen documents). 

14. On or about July 22, 2016, WikiLeaks released tš of thousands of documents 


stolen from the DNC network. These stolen documents included communications by senior DNC 
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officials about campaign strategy, financial and fundraising data, and other documents related to 
the 2016 U.S. federal elections, including the 2016 U.S. presidential election. 

15. Beginning in or around October 2016, WikiLeaks began to release tens of 
thousands of emails and documents stolen from Podesta’s email account. Between on or about 
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of 


documents that had been stolen from John Podesta, releasing a total of over 50,000 stolen 


S documents. 


Stone's Communications About WikiLeaks During the Campaign 


16. In April 2018 interviews with the Special Counsel’s Office, Gates stated that 
starting in or around May 2016, when Gates was a senior official on the Trump campaign, Stone 
informed members of the Trump Campaign that WikiLeaks had emails from then-candidate 
Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by 
WikiLeaks, Gates observed a conversation between Manafort and Stone, in which they discussed 
WikiLeaks and Stone’s prediction of the release. 

17. According to Gates, Manafort directed Gates to contact Stone about any additional 
releases and what other information WikiLeaks had regarding the Clinton Campaign. Gates 
contacted Stone, who made statements claiming that there would be potential future releases of 
damaging material by WikiLeaks. In a separate interview with i Special Counsel’s Office in or 
around October 2018, Gates recalled that at one point during the campaign he was with then- 
candidate Trump in a car when the candidate had a telephone call with Stone; shortly after finishing 


the call with Stone, Gates recalled then-candidate Trump said more leaks were coming. 
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18. Emails recovered through a court-authorized search of Stone’s email account 

2 show that shortly after the July 22, 2016 release of stolen DNC emails 

by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to 
obtain other emails damaging to the Clinton Campaign: 

a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject 
line, “Get to Assange.” The body of the message read, “Get to Assange [alt 
Ecuadorian Embassy in London and get the pending WikiLeaks emails... they 
deal with Foundation, allegedly.” On or about the same day, Corsi forwarded 
Stone’s email to {J who lived in the United Kingdom and was a supporter of 
the Trump Campaign. 

b. On or about July 31, 2016, Stone emailed Corsi with the subject jie “Call me 
MON.” The body of the email read in part that J “should see Assange.” 

c. On or about August 2, 2016, Corsi emailed Stone and wrote that he was currently 
in Europe and planned to return in mid-August. Corsi stated, “Word is friend in 
embassy plans 2 more dumps. One shortly after Pm back. 2nd in Oct. Impact 
planned to be very damaging.” In a law enforcement interview, Corsi stated that 
the phrase “friend in embassy” referred to Assange. Corsi added in the same email, 


“Time to let more than Podesta to be exposed as in bed w enemy if they are not 


2 A search aa ~ °: authorized on or about September 11, 2017 by the U.S. 
District Cow bia. Case No. 1:17-mj-661 (D.D.C. Sept. 11, 2017). A 
second search Bt | was authorized on or about August 3, 2018 by the U.S. 
District Court fo . Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). On or 
about September 26, 2018, the government obtained and executed an order pursuant to 18 U.S.C. 
§ 2703(d) for records connected BO Case No. 1:18-sc-2911 (D.D.C. Sept. 
26, 2018). Records provided in response by Microsoit Corporation confirmed that the account 
was still active and that the relevant emails described in this affidavit were not deleted from the 
account. 
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19. 


ready to drop HRC. That appears to be the game hackers are now about. Would 
not hurt to start suggesting HRC old, memory bad, has stroke — neither he nor she 
well. I expect that much of next dump focus, setting stage for Foundation debacle.” 


According to recorded public statements recovered by the FBI, starting in early 


August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated 
statements about information he claimed to have learned from Assange: 


a. According to a public video posted to YouTube, on or about August 8, 2016, Stone 


attended a public event in Broward County, Florida. During the event, Stone stated, 
“I actually have communicated with Assange. I believe the next tranche of his 
documents pertain to the Clinton Foundation, but there’s no telling what the 


October surprise may be.” 


. According to a public video posted to YouTube, on or about August 12, 2016, Stone 


was interviewed for a video segment on the show Info Wars, hosted by Alex Jones. 
During the interview, Stone stated that he was “in communication with Assange” 


but was “not at liberty to discuss what I have.” 


. According to a public video posted to YouTube, on or about August 16, 2016, Stone 


stated during another interview with Alex Jones that “it became known on this 
program that I have had some back-channel communication with WikiLeaks and 
Assange.” In a second interview on or about the same day with Dana Loesch of 
the TheBlaze TV, Stone stated that he “communicated with Mr. Assange” and that 


they had a “mutual acquaintance who is a fine gentleman.” 


. According to a video posted to the public website of the TV station C-SPAN, during 


a C-SPAN television interview on or about August 18, 2016, Stone stated that he 
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had communicated with Assange through an “intermediary, somebody who is a 

mutual friend.” | 
e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio 
interview he did with Stone on or about August 23, 2016 during which the two 
discussed Stone’s prior claims to be in contact with Assange. At one point during 
| the interview, Credico asked Stone, “You’ve been in touch indirectly with Assange. 
Can you give us any kind of insight? Is there an October surprise happening?” 
Stone responded, “Well, first of all, I don’t want to intimate in any way that I control 
or have influence with Assange because I do not.... We have a mutual friend, 
somebody we both trust and therefore I am a recipient of pretty good information.” 
20. In or around ERR 0 Stone 
produced a series of text messages between Stone and Credico during the 2016 presidential 
campaign.? These text messages show that beginning on or about August 19, 2016, Stone 
exchanged written communications with Credico about what WikiLeaks and Assange planned to 
do. Emails recovered through a court-authorized search of Stone’s email account 
ee show additional written communications between Stone and Credico 

about WikiLeaks in or around September 2016. 

a. Onor ába August 19, 2016, Credico sent a text message to Stone that read in patt, 
‘Tm going to have Julian Assange on my show next Thursday.” On or about 
August 21, 2016, Credico sent another text message to Stone, writing in part, “I 


have Julian Assange on Thursday so I’m completely tied up on that day.” 


3 As discussed below, Stone had previously released some of these text messages to members of 
the media, who had written about them and published them in part. 


10 
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. On or about August 25, 2016, Assange was a guest on Credico’s radio show for the 


first time. On or about August 26, 2016, Credico sent a text message to Stone that 
stated, “Julian Assange talk[ed] about you last night.” Stone replied and asked what 
Assange said, to which Credico responded, “He didn’t say anything bad we were 
talking about how the Press is trying to make it look like you and he are in cahoots.” 
On or about August 27, 2016, Credico sent text messages to Stone that said, “We 
are working on a Julian Assange radio show,” and that he (Credico) was “in charge” 
of the project. In a text message sent later that day, Credico added, “Julian Assange 


has kryptonite on Hillary.” 


. On or about September 18, 2016, Stone sent a text message to Credico that said, “I 


am e-mailing u a request to pass on to assange.” Credico responded “Ok,” and 
added in a later text message, “Just remember do not name me as your connection 
to Assange you had one before that you referred to.” 

Later on or about September 18, 2016, Stone emailed Credico an article with 
allegations against then-candidate Clinton related to her service as Secretary of 
State. Stone stated, “Please ask Assange for any State or HRC e-mail from August 
10 to August 30 -- particularly on August 20, 2011 that mention [the subject of the 
atticle] or confirm this narrative.” 

On or about September 19, 2016, Stone texted Credico again, writing, “Pass my 
message... to Assange.” Credico responded, “I did.” On or about September 20, 
2016, Credico forwarded the request to a close friend who was an attorney with the 


ability to contact the Assange. Credico blind-copied Stone on the forwarded email. 
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g. Onor about September 30, 2016, Credico sent Stone via text message a photo graph 
of Credico standing outside the Ecuadorian Embassy in London where Assange 
was located. 

h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text 
messages that stated, “big news Wednesday... now pretend u don’t know me... 
Hillary’s campaign will die this week.” In the days preceding these messages, the 
press had reported that Assange planned to make a public announcement on or 
about Tuesday, October 4, 2016, which was reported to be the 10-year anniversary 
of the founding of WikiLeaks. 

i. On or about October 2, 2016, Stone emailed Credico, with the subject line “WTF?” 
and a link to an article at the website http://heatst.com/politics/october-surprise- 
thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement-due-to- 
security-concerns. Credico responded to Stone, “head fake.” 

j. On or about Monday, October 3, 2016, Stone wrote Credico and asked, “Did 
Assange back off” Credico initially responded, “I can’t tal[k] about it.” After 
further exchanges with Stone, Credico responded, “I think it[’]s on for beaters 
Credico added, “Off the Record Hillary and her people are doing a full-court press 
they [sic] keep Assange from making the next dump . . . That’s all I can tell you on 
this line . . . Please leave my name out of it.” 

21. Emails and text messages recovered by the FBI show that, in or around October 
2016, Stone made statements about Assange’s future releases, including statements that were 


similar to statement that Credico made to him. For example: 
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a. Ina court-authorized search of Stone’s email — = the 


FBI recovered an email from Stone a sent on or about October 3, 2016, 
which stated in part, “Spoke to my friend in London last night. The payload is still 
coming.” 

b. In a court-authorized search Zo the FBI also recovered an 
email exchange from on or about October 3, 2016 between Stone and a reporter 
who had connections to Steve Bannon. In the exchange, the reporter asked, 
“Assange — what’s he got? Hope it’s good.” Stone responded, “It is. Pd tell 
Bannon but he doesn’t call me back.” 

c. On or about October 4, 2016, Assange held a press conference but did not release 
any new materials pertaining to the Clinton Campaign. In a court-authorized search 
iii -+ FBI recovered an email exchange between Stone and 
Bannon on or about October 4, 2016 that occurred after the press conference. In 
the exchange, Bannon asked, “What was that this morning???,” referring to 
Assange’s press conference. Stone responded, “Fear. Serious security concern. He 
thinks they are going to kill him and the London police are standing do[wn]. 
However —aload every week going forward.” 

d. In a court-authorized search of Stone’s iCloud account,’ the FBI recovered text 


messages between Stone and {from on or about October 4, 2016. In one text 


4 A search of ae: authorized on or about October 17, 2017 by the U.S. 
District Court Tor the District of Columbia. Case No. 1:17-mj-760 (D.D.C. Oct. 17, 2017). A 
second search of ae: authorized on or about August 3, 2018 by the U.S. 
District Court for the District of Columbia. Case No. 1:18-sc-2583 (D.D.C. Aug. 3, 2018). 

> A search of Stone’s iCloud account was authorized on or about March 14, 2018 by the U.S. 
District Court for the District of Columbia. Case No. 1:18-sc-662 (D.D.C. Mar. 14, 2018).’ The 
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message, EN asked Stone if he had “hear[d] anymore from London.” Stone 

- replied, “Yes — want to talk on a secure line — got Whatsapp.” In an interview with 
the Special Counsel’s Office in or around May 2018, GB confirmed that he and 
Stone spoke and that Stone had told him WikiLeaks had more material to release, 
and that the material was related to senior people associated with Clinton. 

22. Onor about October 7, 2016, WikiLeaks released the first set of emails stolen from 
Podesta. According to text messages recovered from Stone’s iCloud account, shortly after the 
release, an associate of Bannon sent a text message to Stone that read, “well done.” Similarly, 
during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release, 


Stone said, “I told you this was coming.” 


Stone’s Communications with the House Permanent Select Committee on Intelligence 
23. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating 


allegations of Russian interference in the 2016 presidential election and possible links to 
individuals associated with political campaigns. During a public HPSCI hearing on or about 
March 20, 2017, multiple HPSCI committee members indicated that Stone’s prior public 
statements about having communications with Assange (particularly those from August 2016) 


were of interest to the committee. 


records for Stone’s iCloud account contained some, but not all, of Stone’s communications from 
the campaign period. 

® On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee 
on Intelligence (‘SSCP’) announced the committee would conduct an inquiry that would 
investigate, among other things, any intelligence regarding links between Russia and individuals 
associated with political campaigns, as well as Russian cyber activity and other “active 
measures” directed against the United States in connection with the 2016 election. 
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24. nor around May 2017, HPSCI sent a letter requesting that Stone voluntarily appear 
before the committee and produce relevant documents to HPSCI (a copy of the HPSCI letter was 


recovered by the FBI from a court-authorized search of Stone’s email account 


© Y The letter requested Stone produce: 


Any documents, records, electronically stored information 
including e-mail, communication, recordings, data and tangible 
things (including, but not limited to, graphs, charts, photographs, 
images and other documents) regardless of form, other than those 
widely available (e.g., newspaper articles) that reasonably could 
lead to the discovery of any facts within the investigation's publicly- 
announced parameters. 


25. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and . 


stated that “Mr. Stone has no documents, records, or electronically stored information, regardless 
of form, other than those widely available that reasonably could lead to the discovery of any facts 
within the investigation’s publicly-announced parameters.” (A copy of the letter was recovered. 
from a court-authorized search of Stone’s email accoun ). 


Stone’s Testimony Before HPSCI 


26. On or about September 26, 2017, Stone provided HPSCI with an “opening 
statement” that his counsel requested be included as part of the record of proceedings before 
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice,’ Stone 


stated, “These hearings are largely based on a yet unproven allegation that the Russian state is 


7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of 
Stone’s interview with HPSCI, as well as any written submissions and/or correspondence from 
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI 
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017 
interview of Roger Stone, a copy of Stone’s written opening statement, and various 
correspondence from Stone’s counsel to members of HPSCI. 
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responsible for the hacking of the DNC and John Podesta and the transfer of that information to 
WikiLeaks.” | 

27. Also on or about September 26, 2017, Stone provided testimony in a closed session 
before HPSCI, at the U.S. Capitol in Washington, D.C. Stone’s testimony was transcribed, and a 
copy of the transcript was obtained by the Department of Justice from HPSCI in or around 


December 2018. Stone appeared before HPSCI under oath and affirmed for the record that he 


would tell the truth. At the beginning of the hearing, Stone was admonished that “it is unlawful to 


deliberately provide false information to Members of Congress or staff’ and that “providing false 
information to this committee or concealing material information from this committee is a crime 


punishable by law.” 


Stone’s Testimony About Documents He Possessed Related to WikiLeaks 
28. During his HPSCI testimony, Stone was asked about HPSCI’s May 2017 document 


request and whether Stone had any documents or written communications that discussed Julian 
Assange, Russian interference, or other relevant documents: 


Q: The committee wrote to you on May 9th requesting no later 
than May 22 any documents, records, electronically stored 
information, including email communication, recordings, 
data, and other tangible things relevant to our investigation. 
You wrote back through counsel that you had no documents, 
records, or electronically stored information regardless of 
form responsive to our requests. Was that a false statement? 


À: That is not a false statement. That’s what -- I believe that to 
be true. 


Q: So you have no emails to anyone concerning the allegations 
of hacked documents or your conversations with the 
Guccifer 2[.0] or any discussions you have had with third 
parties about Julian Assange? You have no emails, no texts, 
no documents whatsoever, any kind of that nature? 
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A: That is correct. Not to my knowledge. I think we met, again, 
the precise criteria of your request, and we complied. Again, 
if you have a mote specific request, I'm happy to go back and 


look. ... 

Q: I just want to ask you under oath — 

A: We did an extensive search consistent with the direction of 
my attorneys, and we found nothing that met the criteria that 
you asked for. 

Q: I just want to be certain because you are under oath, where 


your letter was not under oath, that you have no documents, 
no emails, no texts, no tweets that refer to Julian Assange or ` 
Guccifer 2].0] or Paul Manafort or the allegations 
concerning Russian connections with the campaign. You 
have had no discussions in any written form. You've written 
no documents yourself. 


A: In connection with Russian collusion, consistent with your 
exact and precise request, yes. 


29. In fact, and as described above, Stone had sent and received numerous emails and 
text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and 
WikiLeaks possession of hacked emails. Court-authorized searches of Stone’s email accounts 
(rnin ll and his iCloud account show that, 
at the time of his testimony, Stone was still in possession of many of these emails and text messages 
at the time he testified on or about September 22, 2017.8 These written communications included 
(a) Stone’s email to Corsi on or about July 25, 2016, that read in part, “Get to Assange [a]t 


Ecuadorian Embassy in London and get the pending WikiLeaks emails... they deal with 


8 The warrant for Stone’s email account [iin was obtained on or about 
September 11, 2017 and executed shortly thereafter. Records provided in or around September 
2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the account 
was active and the emails in question were not deleted from the account. The warrant for Stone’s 
email coun an M obtained on or about October 17, 2017 and executed 
shortly thereafter. The warrant for stone’s iCloud account (which contained the text messages 


described above) was obtained on or about March 14, 2018 and executed shortly thereafter. 
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Foundation, allegedly.”; (b) Stone’s email to Corsi on or about July 31, 2016 that J “should 
see Assange”; (c) Corsi’s email to Stone on or about August 2, 2016 that stated in part, “Word is 
friend in embassy plans 2 more dumps. One shortly after m back. 2nd in Oct. Impact planned 
to be very damaging.”; (d) dozens of text messages and emails between Stone and Credico, 
beginning on or about August 19, 2016 and continuing through duration of the election, in which 
they discussed WikiLeaks and Assange; (e) Stone’s email to J on or about October 3, 2016 
that read in part “Spoke to my friend in London last night. The payload is still coming.”; and (f) 
Stone’s email to Bannon on or about October 4, 2016 that claimed WikiLeaks would release “a 
load every week going forward.” 
Stone ’s Testimony About His Early August 2016 Statements 

30. During his HPSCI testimony on or about September 26, 2017, Stone was asked to 
explain his statements in early August 2016 about being in contact with Assange. Stone was 
specifically asked about his statement on or about August 8, 2016 that “I’ve actually 
semaines with Assange,” as well as his statement on or about August 12, 2016 that he was 
“in communication with Assange” but was “not at liberty to discuss what I have.” 

31. Stone testified that these public references to having a means of contacting 
WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a “go- 
between, as an intermediary, as a mutual friend” of Assange. Stone declined to tell HPSCI the 
name of this “intermediary,” but he provided a description in his testimony that was largely 
consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to 
HPSCI that identified Credico by name as the “gentleman who confirmed for Mr. Stone” that 


Assange had “‘[e]mails related to Hillary Clinton which are pending publication.’”). 


32. In fact, documents recovered during the investigation re) 
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Pd show that Stone did not begin communicating 


with Credico about Assange or WikiLeaks until on or about August 19, 2016°—approximately 
eleven days after Stone first claimed on or about August 8, 2016 to “actually have communicated 
with Assange” and a week after to his August 12, 2016 statements of being “in communication 
with Assange” and “not at liberty to discuss what I have.” 

33. | When interviewed by the FBI, Credico stated that the first time he ever spoke with 
Assange was on or about August 25, 2016, when Credico interviewed Assange.!° Credico also 
provided the FBI with partially redacted emails that he claimed were between he and another 
member of WikiLeaks from on or about August 25, 2016, in which the two discuss the technical 
logistics for the interview later that day. During the exchange, Credico offered biographical 
information about himself, apparently as a means of introduction. 

34. The FBI has not identified any communications between Stone and Credico from 
August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When interviewed 
by the FBI, Credico claimed he was never directed by Stone in August 2016 to contact WikiLeaks. 

35. In contrast, and as described above, the FBI has identified written communications 
prior to August 8, 2016 in which Stone directed Corsi—not Credico—to contact Assange. On or 
about July 25, 2016, for example, Stone wrote to Corsi, “Get to Assange [a]t Ecuadorian Embassy 
in London and get the pending WikiLeaks emails . . . they deal with Kadin allegedly.” 


Similarly, on or about August 2, 2016, Corsi—not Credico—sent an email to Stone in which Corsi 


? As described above, on or about August 19, 2016, Credico informed Stone by text message that 
Credico intended to interview Assange the following week. On or about August 25, 2016, Credico 
interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico texted 
Stone that “Assange has kryptonite on Hillary.” 


10 Credico was first interviewed by the FBI in or around August 2018. He has subsequently 


participated in multiple voluntary interviews. 
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- wrote that “[w]ord is friend in embassy plans 2 more dumps,” including one in October. These 
communications occurred days before Stone’s first public statement on or about August 8, 2016 
claiming to be in communication with Assange. However, at no time did Stone identify Corsi to 
HPSCI as another individual Stone contacted to serve as a “go-between,” “intermediary,” or other 
source for information from WikiLeaks. Stone also never disclosed his written communications 
with Corsi to HPSCI when answering HPSCI’s questioning about the August 8, 2016 and August 
12, 2016 statements about being in communication with Assange. | 


Stone's Testimony About Communications to Assange 


36. During his HPSCI testimony, Stone was asked, “Did you ask [the intermediary] to 
communicate anything else to Assange?” Stone responded, “I did not.”: Stone was then asked, 
“Did you ask [the intermediary] to do anything on your own behalf?” Stone responded, “I did 


not.” 


37. In fact, starting on or about September 18, 2016, Stone directed Credico to pass on 


a request to Assange for documents that Stone believed would be damaging to the Clinton 
Campaign. 

a. According to text messages E oo or about 

September 18, 2016, Stone sent a text message to Credico that said, “I am e-mailing 

u a request to pass on to Assange.” On or about the same day, Stone emailed 

Credico an article with allegations against then-candidate Clinton related to her 

service as Secretary of State. Stone added, “Please ask Assange for any State or 

HRC e-mail from August 10 to August 30 — particularly on August 20, 2011 that 


mention [the subject of the article] or confirm this narrative.” (A copy of this email 


was obtained through a search of Stone’s email a O 
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b. According to text messages PY on or about 


September 19, 2016, Stone texted Credico again, writing “Pass my message ... to 
Assange.” Credico responded, “I did.” An email obtained from the account 

[eee shows that on or about September 20, 2016, Credico 
forwarded the request to an attorney who had the ability to contact Assange; 
Credico blind copied Stone on the same email. 


Stone’s Testimony About Written Communications with Credico 


38. During his HPSCI testimony, Stone was asked repeatedly about his 
communications with the person he identified as his intermediary. Stone stated that he had never 
communicated with his intermediary in writing in any way. During one exchange, Stone claimed 
only to have spoken with the intermediary telephonically: 

Q: [H]ow did you communicate the intermediary? 
A: Over the phone. 


Q: And did you have any other means of communicating with 
the intermediary? l 


A: No. 
Q: No text messages, no — none of the list, right? 
A: No. 


Later during his testimony, Stone again denied ever communicating with his intermediary in 
writing: 


Q: So you never communicated with your intermediary in 
writing in any way? 


A: No. 
Never emailed him or texted him? 


He’s not an email guy. 
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Q: So all your conversations with him were in person or over 
the phone. 
A: Correct. 


39. As described above, Stone and Credico (who Stone identified as his intermediary) 
engaged in frequent written communication by email and text message. Beginning on or about 
August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone and Credico 
engaged in dozens of communications by email or text message in which they discussed 
WikiLeaks and the decane release of stolen documents that would be damaging to the Clinton 
Campaign. 

40. Written communications between Stone and Credico continued up until Stone’s 
HPSCI testimony and afterwards. For example, on or about September 26, 2017—the day that 
Stone testified before HPSCI and denied having ever sent or received emails or text messages from 
his identified intermediary, Stone and Credico exchanged over thirty text messages. 

41. Certain of the electronic messages between Stone and Credico (which Stone denied 
ever taking place or possessing) would have been material to HPSCI, including Stone’s messages 
in or around September 2016 directing Credico to pass a request for documents to Assange, and 
other relevant written communications with Credico. For example, on or about January 6, 2017, 
Credico sent Stone an email, which Stone had in his possession at the time of his HPSCI testimony, 
that had the subject line “Back channel bs.” In the email, Credico wrote, “Well I have put together 
_ timelines[] and you [] said you have a back-channel way back a month before I had Assange on 
my show... I have never had a conversation with Julian Assange other than my radio show... I 


have pieced it all together . . . so you may as well tell the truth that you had no back-channel or 


there’s the guy you were talking about early August.” (A copy of this email was obtained through . 


a search of Stone’s email account a 
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Stone ’s Testimony About Communications with the Trump Campaign 


42. During his HPSCI testimony, Stone was asked, “[d]id you discuss your 
conversations with the intermediary with anyone involved in the Trump campaign?” Stone 
answered, “I did not.” As described above, Stone spoke to multiple individuals involved in the 
Trump campaign about what he claimed to have learned from his intermediary to Assange, 
including the following: 

a. As described above, Gates confirmed to investigators that Stone spoke with senior 
Trump Campaign officials to inform them about materials possessed by Assange 


and the timing of future releases. 


3, 2016, Stone wrote to I. “Spoke to my friend in London last night. The 


payload is still coming.” 

c. As described above, on or about October 4, 2016, after receiving information from 
Credico about the delay in WikiLeaks’s release of stolen materials, Stone emailed 
Bannon that Assange had a “[s]erious security concern” but would release “a load 
every week going forward.” 


Stone’s Attempts to Influence Credico Regarding HPSCI and the FBI 


43. According to an email recovered through a court-authorized search of Stone’s email 
acco on or about October 19, 2017, Stone sent Credico an excerpt of 
his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his “intermediary” to 
Assange. As described below, Credico repeatedly told Stone that his letter was false and said he 
should correct his statement to HPSCI, but Stone did not do so. Stone then engaged in a prolonged 


effort to prevent Credico from contradicting Stone’s false statements to HPSCI. 
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44, —_ In or around November 2017, Credico received a request from HPSCI to testify 


voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted 


repeatedly with Stone, es 


a. On or about November 19, 2017, Credico texted Stone that his Lae wanted to 
see him. Stone responded, “‘Stonewall it. Plead the fifth. Anything to save the 
plan’... Richard Nixon.” (A copy of these text messages was recovered through 
a court-authorized search of Stone’s iCloud account). On or about November 20, 
2017, Credico informed HPSCI that he declined HPSCI’s request for a voluntary 
interview. 

b. On or about November 21, 2017, Credico texted Stone, “I was told that the house 
committee lawyer told my lawyer that I will be iie a subpoena.” Stone 
responded, “That was the point at which your lawyers should have told them you 
would assert your Sth Amendment rights if compelled to appear.” (A copy of these 
text messages was recovered through a court-authorized ska of Stone’s iCloud 
account). 

c. On or about November 28, 2017, Credico received a subpoena compelling his 
testimony before HPSCI. Credico informed Stone of the subpoena. 

d. According to emails recovered from Stone’s email accoun fi 
on or about November 30, 2017, Stone asked Corsi to write publicly about Credico. 


Corsi responded, “Are you sure you want to make something out of this now? Why 
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not wait to see what [Credico] does? You may be defending yourself too much — 
raising new questions that will fuel new inquiries. This may be a time to say less, 
not more.” Stone responded by telling Corsi that Credico “will take the 5th—but 
let’s hold a day.” 

e. According to text messages recovered from Stone’s iCloud account, on multiple 
occasions, starting on or about November 17, 2017, Stone and Credico discussed . 
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part 
II, who falsely claims not to know critical information before a congressional 
committee that he does in fact know. On or about December 1, 2017, Stone told 
Credico in a text message to “Start practicing your Pentagele.” When interviewed 
by the FBI, Credico EE R that he understood Stone’s references to Frank 
Pentangeli to be Stone’s way of suggesting Credico withhold relevant information 
from investigators. 

f. On or about December 1, 2017, Stone texted Credico, “And if you turned over 
anything to the FBI you’re a fool.” Later that day, Credico texted Stone, “You need 
to amend your testimony before I testify on the 15th.” Stone responded, “If you 
testify you’re a fool. Because of tromp I could never get away with a certain [sic] 
my Fifth Amendment rights but you can. I guarantee you you are the one who gets 
indicted for perjury if you’re stupid enough to testify.” (A copy of these text 

, Messages was recovered through a court-authorized search of Stone’s iCloud 
account). 
45. On or about December 12, 2017, Credico informed HPSCI that he intended to assert 


his Fifth Amendment privilege against self-incrimination if required to appear by subpoena. 
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According to Credico, he invoked his Fifth Amendment privilege in pace to avoid providing | 
evidence that would show Stone’s previous testimony to Congress was false. 

46. l Following Credico’s invocation of his Fifth Amendment privilege not to testify 
before HPSCI, Stone and Credico continued to have discussions about the various investigations 
into Russian interference in the 2016 election and what information Credico would provide to 
investigators. During these conversations, Stone repeatedly made statements intended to prevent | 
Credico from cooperating with the investigations. For example: 

a. On or about December 24, 2017, Credico texted Stone, “I met assange for f[i]rst 


time this yea[r] sept 7 . . . docs prove that . . . You should be honest w fbi... 


there was no back channel . . . be honest.” Stone replied approximately two 
minutes later, “I’m not talking to the FBI and if your smart you won’t either.” (A 
copy of these text messages was recovered through a court-authorized search of 
Stone’s iCloud account). 

b. On or about April 9, 2018, Stone wrote in an email to Credico, “You are a rat. A 
stoolie. You backstab your friends—run your mouth my lawyers are dying Rip you 


to shreds.” Stone also said he would “take that dog away from you,” referring to 


Credico’s dog. On or about the same day, Stone wrote to Credico, “I am so ready. 
Let’s get it on. Prepare to die [expletive].” (A copy of this email exchange was 


recovered through a court-authorized search of Stone’s email account 


c. On or about May 21, 2018, Credico wrote in an email to Stone, “You should have 


just been honest with the house Intel committee ... you’ve opened yourself up to 


perjury charges like an idiot.” Stone responded, “You are so full of [expletive]. 
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You got nothing. Keep running your mouth and PI file a bar complaint against 
l your friend [the attorney who had the ability to contact Assange].” (A copy of this 
email exchange was recovered through a court-authorized search of Stone’s email 
co. Credico believed Stone knew that Credico was 
sensitive to having this friend’s name publicly disclosed. . 


Missing Electronic Communications and Stone’s Use of Encrypted Communications 


47. As described above, the government has recovered the content of many of Stone’s 
electronic communications from summer and fall of 2016 (during the period of the U.S. 
presidential election) and afterward (during the period of pending congressional investigations into 
Russian interference in the U.S. election). However, the government is aware of the existence of 
numerous other relevant electronic communications that it has not yet been able to recover the 
content. 

48. As described above, during his HPSCI testimony, Stone falsely denied having 
emailed or exchanged text messages with his “intermediary” (later identified by Stone as Randy 
Credico). In fact, emails and text messages recovered in this investigation show the two 
communicated frequently by email and text messages; court-authorized searches of Stone’s email 
and iCloud accounts confirm that Stone still had those communications at the time he testified in 
or around September 2017. In numerous communications, Stone and Credico discussed Julian 
Assange sad WikiLeaks, as well as Stone’s suggestion that Credico was his intermediary to 
Assange. These communications appear relevant and responsive to HPSCI’s inquiry, but Stone 
never disclosed them. 

49. In addition to these emails and text messages in the FBI’s possession, the FBI has 


reviewed telephone billing records for Stone’s cellular telephone for the years 2016 and 2017 and 
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they show text message communications whose content that the government to date has not been 
able to obtain. For example, these records indicate that Stone and Credico alone exchanged 
thousands of text messages (including over 1,500 text messages between the period November 
2016 and December 2017) the substance of which the government to date has not recovered or 
reviewed. The government has only recently obtained text messages between Stone and Credico 
during some period of the campaign in 2016 from Stone’s subpoena production, issued after media 
reports in November 2018 stated that Stone’s attorneys were able to extract text messages between 
Stone and Credico from a phone Stone stopped using in 2016. But the government does not have, 
for the same time period, many of Stone’s other text messages. The government seeks these text 
messages believing they may show additional evidence of (1) the falsity of Stone’s HPSCI 
testimony concerning his communications with his “intermediary” and (2) efforts to corruptly 
persuade Credico not to cooperate with pending investigations. | 

50. Additionally, the FBI has interviewed multiple associates of Stone, who confirmed 
that Stone has used encrypted applications to communicate with others. Similarly, records 


obtained in this investigation indicate Stone uses multiple applications designed for encrypted 
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communication, including (a) WhatsApp,!! (b) Signal,” (c) Wickr,!3 and (d) ProtonMail.!* To 
date, the FBI has not obtained any of Stone’s communications conducted through these 


applications. 
a. According to records from Stone’s iCloud account, a copy of the WhatsApp 
application was downloaded to an iPhone registered to Stone on or about October 
5, 2016. As described above, on or about October 4, 2016, Stone suggested in an 
email to B that they “talk ona secure line” and proposed using WhatsApp. 
b. According to records from Stone’s iCloud account, a copy of the Signal application 
was downloaded to an iPhone registered to Stone on or about August 18, 2016. 
Additionally, text messages recovered from Stone’s iCloud account revealed that 


on or about November 15, 2016, Stone sent an attorney with the ability to contact 


11 According to open sources, WhatsApp is an application that allows the user to send text 
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and 
stores its messages separately from those text messages used on a mobile device’s default message 
application. 

” According to open sources, Signal is an encrypted communications application allowing the user 
to send one-to-one and group messages, which can include files, voice notes, images and videos, 
and make one-to-one voice and video calls. Signal uses standard cellular mobile numbers as 
identifiers, and uses end-to-end encryption to secure all communications to other Signal users. 
Signal also allows users to set timers to messages, after which the messages will be deleted from 
both the sender’s and the receivers’ devices. 


3 According to open sources, Wickr is an instant messaging application that allows users to 
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file 
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows 
users to set an expiration time for their encrypted communications. In addition to encrypting user 
data and conversations, Wickr claims that its application strips metadata from all content 
transmitted through the network. 

4 According to open sources, ProtonMail is an end-to-end encrypted email service that uses client- 
side encryption to protect email contents and user data before they are sent to ProtonMail servers. 
According to its website, ProtonMail is run by Proton Technologies AG, a company based in the 
Canton of Geneva, and its servers are located at two locations in Switzerland, outside of US and 


EU jurisdiction. 
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Julian Assange a link to download the Signal application.'> Approximately fifteen 
minutes after sending the link, Stone texted the attorney, “I’m on signal just dial 
my number.” The attorney responded, “PI call you.” 
c. According to records from Stone’s iCloud account, a copy of the ProtonMail 
application was downloaded to an iPad registered to Stone on or about August 18, 
2016. 
d. According to records from Stone’s iCloud account, a copy of the Wickr application 
was downloaded to an iPhone registered to Stone on or about August 5, 2017. 
51. Based on my training and experience, electronic communications using encrypted 
applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the 
device used to send and receive those communications. Communications from those applications 


can be obtained by law enforcement by searching the device either manually or via a data 


extraction device (such as Cellebrite). Searches of the physical device can reveal messages, 


including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and Wickr, 
that have not been backed up to cloud accounts (such as an iCloud account). Additionally, review 
of the device and the downloaded application can reveal other evidence of encrypted 
communications, such as call logs and contact lists. 

52. The FBI continues to seek evidence of Stone’s communications and contacts during 
the period of the 2016 U.S. presidential election and through the present. The FBI believes these 
communications may contain evidence of additional E E concerning Assange, 


WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign. Such 


15 This attorney was a close friend of Credico’s and was the same friend Credico emailed on or 
about September 20, 2016 to pass along Stone’s request to Assange for emails connected to the 
allegations against then-candidate Clinton related to her service as Secretary of State. 
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communications could constitute additional evidence of Stone’s efforts to obstruct HPSCI’s 
investigation by showing additional contacts and communications about Assange and WikiLeaks 


that Stone failed to disclose. 


Other Relevant Communications 


53. On May 8, 2018, a law enforcement interview iii was 


conducted. Gas an employee of Stone’s from approximately June 2016 through 


approximately December 2016 and resided in Stone’s previous New York apartment for a period 
of time. GB provided information technology support for Stone, but was not formally trained to 
do so. Gas aware that Stone communicated with Trump during the 2016 presidential 
campaign, and afterward, both in person and by telephone. {provided information about a 
meeting at Trump Tower between Trump and Stone during the time worked for him, to which 
Stone carried a “file booklet” with him. Stone oil the file booklet was important and that 
no one should touch Eo also said Stone maintained the file booklet in his closet. 

54, On December 3, 2018, law enforcement conducted an interview of an individual 
(“Person 1”) who previously had a professional relationship with a reporter who provided Person 
1 with information about Stone. The reporter relayed to Person 1 that in or around January and 
February 2016, Stone and Trump were in constant communication and that Stone kept 
contemporaneous notes ofthe conversations. Stone’s purpose in keeping notes was to later provide 


a “post mortem of what went wrong.” 
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B. Probable Cause Justifying Search of the Subject Premises 


55. . Your affiant is aware through the investigation that Stone maintains the Subject 
Premises as his secondary residence.!® Associates of Stone’s have confirmed that Stone maintains 


the Subject Premises as his residence when he visits New York, New York.!” 


56. Billing records provided by Charter Communications PO 
GE (ctermined that the subscriber of services at the Subject Premises S 


In a law enforcement interview, B stated he worked as Stone’s assistant. The interview of 
1 in addition to a review of public source records, determined == lives in Florida. 
Your affiant believes MJ established the Charter Communications account at the Subject 


Premises on behalf of Stone. 


58. Stone participated in an on camera interview that was aired on or about November 


2018 at the Subject Premises!*. Your affiant observed an Apple MacBook Pro computer and an 
iMac in the Subject Premises in the interview. In the interview, Stone was observed departing the 


apartment building that houses the Subject Premises. 


17 Public real estate listing indicates the Subject Premises has been listed since December 5, 2018 
and will become available for rent on February 1, 2019. A broker for the Subject Premises listing 
stated it was not available for viewing until February 1, 2019 because it was still occupied by the 
tenant. 

18 https://www.washingtonpost.com/politics/201 8/1 1/08/roger-stone-has-rule-deny-everything- 
he-does/?utm_term=.5ab41ac5df22 
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59. A review of records produced by Uber Technologies, Inc., Mae ])) 
e) determined that on or about December 2018, the user of the account associated with 
Stone’s telephone number and email address used Uber services at addresses at or close to the 
Subject Premises. Your affiant is aware that users of Uber’s services do not always use their 
’ precise address when arranging for transportation, and believes the addresses close to the Subject 
Premises are consistent with an individual whose destination is the Subject Premises. 

60. Based on law enforcement interviews, your affiant is ais that Stone has used and 
uses cellular telephones, desktop, and laptop computers to conduct electronic communications. 
Stone also configures his computers to create regulars backups of his computers and maintains one 
of these devices at the Subject Premises, which preserves documents and communications. 

61. In or around May 2018, the FBI interviewed an individual (“Person 2”) who 
provided information technology services to Stone. According to Person 2, Stone maintains at 
least one Apple computer in each of his residences and also had an Apple MacBook Pro laptop 
computer at one point in time. I Person 2 revealed billing receipts 
and invoices issued to Nydia Bertran-Stone for information technology (“IT”) services dated 
January 2015 through May 2018. The records also show that Nydia Bertran-Stone was billed for 
IT services in connection with three different Apple computers. Specifically, the billing receipts 
show services for (1) an Apple iMac (serial number D25SY03RGQ17) configured with the name 
“Stone-Roger-iMac-FL”; (2) a second Apple iMac (serial number D25TC077GQ17) configured 
with the name “Stone-Roger-iMac-NYC”; and (3) an Apple MacBookPro 10 (serial number 
C0O2KLOSEFFT4) configured with the name “Stone-Nydia-MBPR.” According to publicly 
available information, the iMac is one of Apple’s desktop models (i.e., a computer designed to be 


stationary). The naming convention of the computer “Stone-Roger-iMac-NYC” therefore 
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suggests it is a stationary computer used by Stone and located at the Subject Premises. According 
to the billing records, Person 2 was requested to perform remote support services on or about 
March 21, 2018 on the computer named “Stone-Roger-iMac-NYC.” 

62. Inthe aforementioned Washington Post interview of Stone, at least two electronic 
devices are visible to the view, specifically an Apple iMac computer and a MacBook Pro laptop 
computer. 

63. Person 2 also told law enforcement that Stone used the Apple Time Machine 
(“Time Machine”) application to facilitate backups of his computers and that he believed Stone 
used Time Machine on computers in its residences. According to publicly available information, 
Time Machine is the built-in wd feature of Apple computers and can create copies of files on 
a computer, including applications, music, photos, email, documents, and system files. A Time 
Machine backup allows users to restore files from a specific point in time if the original files are 
ever deleted, or if the hard drive is erased or replaced. In order to create backups with Time 
Machine, a user connects an external storage device to the computer and selects that external 


storage device as the backup disk.” 


64. — Records produced by 0 show that, since 


2016, Stone has had multiple Apple iPhone devices registered to his personal cellular telephone 
number (ending inf According to AT&T, as of January 1, 2015 through approximately 


November 14, 2016, Stone’s telephone number was registered to an Apple iPhone model 5s 


19 According to multiple associates of Stone interviewed by the FBI, Stone maintains an office in 
the Subject Residence and conducts most of his work from the office when he is in Florida. 


20 When the external is plugged in, the Time Machine will automatically make hourly backups for 
the past 24 hours, daily backups for the past month, and weekly backups for all previous months. 
The oldest backups are deleted when the external storage device selected as the backup disk is full. 
The external device can be as small as a USB thumb drive. 
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(“iPhone 5s”) (IMSI 310410657061814). On or about November 14, 2016, Stone’s cellular 
telephone number was transferred to an Apple iPhone model 7 (“iPhone 7”) (IMSI 
310410930460769). On or about September 28, 2018, Stone’s cellular telephone number was 
transferred to an Apple iPhone model XS (“iPhone XS”) (IMSI 3 10410155529814). 

65. Records produced by Uber Technologies, : 
show that the account sasoca with Stone’s telephone number and email address has the Uber 
application on multiple devices, including a device identified as iPhone11,2, UDID - 668EDC66- 
29BF-4AD2-8BCA-D974C7906597. Publicly available information indicates that the identifier 
“iPhonel1,2” correlates to an Apple iPhone model XS. Additionally, the subpoena returns 
identified a device identified as iPhone9,4, UDID - 7161CF59-6F 10-41C8-984B- 


DE08401EDA74. Publicly available information indicates that the identifier iPhone9,4 correlates 


to an Apple iPhone model iPhone 7 Plus. 
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67. Statements attributed to Stone in recent media articles also indicate that Stone 


retains computer devices that he no longer uses and keeps relevant electronic communications on 
those devices. In or around November 2018, media reports began to publish excerpts of text 
messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies 
of these text messages subsequently were obtained from — ff 
According to these news articles, Stone released these messages to the media outlets, which Stone 
claimed were extracted by his lawyers from “a cell phone he stopped using in 2016.” Based on 
these statements, your affiant believes the cellular telephone referenced in the article to be the 
iPhone 5s documented in the aforementioned AT&T records (which records indicate he stopped 
using on or about November 14, 2016). Further, your affiant believes Stone maintains other 
devices he is no longer actively using. 


G: Probable Cause Justifying Search of ESI 


68. I submit that if a computer or storage medium is found on the Subject Premises, 
there is probable cause to believe those records will be stored on that computer or storage medium, 


for at least the following reasons: 


23 See, e.g, “Bombshell Text Messages Support Roger Stone’s Claims About WikiLeaks 
Backchannel,” Daily Caller, Nov. 14, 2018, available at https://dailycaller.com/2018/11/14/roger- 
stone-wikileaks-randy-credico-mueller. 

4 OoOo Sore produced some text messages between he and 
Credico; the latest-in-time text message produced by Stone occurred on or about November 14, 
2016. The government believes copies of later-in-time text messages from late 2016 and early 
2017 could be located on another device, such as the iPhone 7 described above, or on backup 
storage media. 
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a. Based on my knowledge, training, and experience, I know that computer files or 


remnants of such files can be recovered months or even years after they have been 
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic 
files downloaded to a storage medium can be stored for years at little or no cost. 
Even when files have been deleted, they can be recovered months or years later 
using forensic tools. This is so because when a person “deletes” a file on a 
computer, the data contained in the file does not actually disappear; rather, that data 
remains on the storage medium until it is overwritten by new data. 

Therefore, deleted files, or remnants of deleted files, may reside in free space or 
slack space—that is, in space on the storage medium that is not currently being used 
by an active file—for long periods of time before they are overwritten. In addition, 
a computer’s operating system may also keep a record of deleted data in a “swap” 
or “recovery” file. | 

Wholly apart from user-generated files, computer storage media—in particular, 
computers’ internal hard drives—contain electronic evidence of how a computer 
has been used, what it has been used for, and who has used it. To give a few 
examples, this forensic evidence can take the form of operating system 
configurations, artifacts from operating system or application operation, file system 
data structures, and virtual memory “swap” or paging files. Computer users 
_ typically do not erase or delete this evidence, because special software is typically 
required for that task. However, it is technically possible to delete this information. 
Similarly, files that have been viewed via the Internet are sometimes automatically 


downloaded into a temporary Internet directory or “cache.” 
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69. As further described in Attachment A, this application seeks permission to locate 
not only computer files that might serve as direct evidence of the crimes described on the warrant, 
but also for forensic electronic evidence that establishes how computers were used, the purpose of 
their use, who used them, and when. There is probable cause to believe that this forensic electronic 
evidence will be on any storage medium in the Subject Premises because: 

a. Data on the storage medium can provide evidence of a file that was once on the 
storage medium but has since been deleted or edited, or of a deleted portion of a 
file (such as a paragraph that has been deleted from a word processing file). Virtual 
memory paging systems can leave traces of information on the storage medium that 
show what tasks and processes were recently active. Web browsers, e-mail 
programs, and chat programs store configuration information on the storage 
medium that can reveal information such as online nicknames and passwords. 
Operating systems can record additional information, such as the attachment of 
peripherals, the attachment of USB flash storage devices or other external storage 
media, and the times the computer was in use. Computer file systems can record 
information about the dates files were created and the sequence in which they were 
created, although this information can later be falsified. 

b. As explained herein, information stored within a computer ail other electronic 
storage media may provide crucial evidence of the “who, what, why, when, where, 
and how” of the criminal conduct under investigation, thus enabling the United 
States to establish and prove each element or alternatively, to exclude the innocent 
from further suspicion. In my training and experience, information stored within a 


computer or storage media (e.g., registry information, communications, images and 
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movies, transactional information, records of session times and durations, internet 
history, and anti-virus, spyware, and malware detection programs) can indicate who 
has used or controlled the computer or storage media. This “user attribution” 
evidence is analogous to the search for “indicia of occupancy” while executing a 
search warrant at aresidence. The existence or absence of anti-virus, spyware, and 
malware detection programs may indicate whether the computer was remotely 
accessed, thus inculpating or exculpating the computer owner. Further, computer 


and storage media activity can indicate how and when the computer or storage 


media was accessed or used. For example, as described herein, computers typically 
contains information that log: computer user account session times and durations, 


computer activity associated with user accounts, electronic storage media that 


connected with the computer, and the IP addresses through which the computer 
accessed networks and the internet. Such information allows investigators to 


understand the chronological context of computer or electronic storage media 


access, use, and events relating to the crime under investigation. Additionally, 
some information stored within a computer or electronic storage media may provide 
crucial evidence relating to the physical location of other evidence and the suspect. 
For example, images stored on a computer may both show a particular location and 
have geolocation information incorporated into its file data. Such file data typically 
also contains information indicating when the file or joes was created. The 


existence of such image files, along with external device connection logs, may also 


indicate the presence of additional electronic storage media (e.g., a digital camera 


or cellular phone with an incorporated camera). The geographic and timeline 
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information described herein may either inculpate or exculpate the computer user. 
Last, information stored within a computer may provide jeleva insight into the 
computer user’s state of mind as it relates to the offense under investigation. For 
example, information within the computer may indicate the owner’s motive and 
intent to commit a crime (e.g., internet searches indicating criminal planning), or 
consciousness of guilt (e.g., running a “wiping” program to destroy evidence on the 
computer or password protecting/encrypting such evidence in an effort to conceal 
it from law enforcement). 

c. A person with appropriate familiarity with how a computer works can, after 
examining this forensic evidence in its proper context, draw conclusions about how 
computers were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact files, blocks, registry entries, logs, or other 
forms of forensic evidence on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. While it is possible to specify in advance 
the records to be sought, computer evidence is not always data that can be merely 
reviewed by a review team and passed along to investigators. Whether data stored 
on a computer is evidence may depend on other information stored on the computer 
and the application of knowledge about how a computer behaves. Therefore, 
contextual information necessary to understand other evidence also falls within the 
scope of the warrant. 

e. Further, in finding evidence of how a computer was used, the purpose of its use, 
who used it, and when, sometimes it is necessary to establish that a particular thing’ 


is not present on a storage medium. For example, the presence or absence of 
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counter-forensic programs or anti-virus programs (and associated data) may be 


relevant to establishing the user’s intent. 


II. Procedures for Searching ESI 
A, Execution of Warrant for ESI 


70. Federal Rule of Criminal Procedure 41(e)(2)(B) provides that a warrant to search 


for and seize property “may authorize the seizure of electronic storage media or the seizure or 


copying of electronically stored information .. . for later review.” Consistent with Rule 41, this - 


application requests authorization to seize any computer devices and storage media and transport 


them to an appropriate law enforcement facility for review. This is typically necessary for a number 


of reasons: 


e First, the volume of data on computer devices and storage media is often impractical 
for law enforcement personnel to review in its entirety at the search location. 


e Second, because computer data is particularly vulnerable to inadvertent or intentional 
modification or destruction, computer devices are ideally examined in a controlled 
environment, such as a law enforcement laboratory, where trained personnel, using 
specialized software, can make a forensic copy of the storage media that can be 
subsequently reviewed in a manner that does not change the underlying data. 


e Third, there are so many types of computer hardware and software in use today that it 
can be impossible to bring to the search site all of the necessary technical manuals and 
specialized personnel and equipment potentially required to safely access the 
underlying computer data. 


e Fourth, many factors can complicate and prolong recovery of data from a computer 
device, including the increasingly common use of passwords, encryption, or other 
features.or configurations designed to protect or conceal data on the computer, which 
often take considerable time and resources for forensic personnel to detect and resolve. 

71. Inmost cases, a thorough search of a premises for information that might be stored 

on storage media often requires the seizure of the physical storage media and later off-site review 


consistent with the warrant. In lieu of removing storage media from the premises, it is sometimes 


possible to make an image copy of storage media. Generally speaking, imaging is the taking of a 
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complete electronic picture of the computer’s data, including all hidden sectors and deleted files. 
Either seizure or imaging is often necessary to ensure the accuracy and completeness of data 
recorded on the storage media, and to prevent the loss of the data either from accidental or 
intentional destruction. This is true because of the following: 

a. The time required ioi an examination. As noted above, not all evidence takes the 
form of documents and files that can be easily viewed on site. Analyzing evidence 
of how a computer has been used, what it has been used for, and who has used it 
requires considerable time, and taking that much time on premises could be 
unreasonable. As explained above, because the warrant calls for forensic electronic 
evidence, it is exceedingly likely that it will be necessary to thoroughly examine 
storage media to obtain evidence. Storage media can store a large volume of 
information. Reviewing that information for things described in the warrant can 
take weeks or months, depending on the volume of data stored, and would be 
impractical and invasive to attempt on-site. 

b. Technical requirements. Computers can be configured in several different ways, 
featuring a variety of different operating systems, application software, and 
configurations. Therefore, searching them sometimes requires tools or knowledge 


that might not be present on the search site. The vast array of computer hardware 


and software available makes it difficult to know before a search what tools or: 


knowledge will be required to analyze the system and its data on the Premises. 
However, taking the storage media off-site and reviewing it in a controlled 


environment will allow its examination with the proper tools and knowledge. 
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c. Variety of forms of electronic media. Records sought under this warrant could be 
stored in a variety of storage media formats that may require off-site reviewing with 
specialized forensic tools. 

72. Because multiple people share the Subject Premises as a residence, it is possible 
that the Subject Premises will contain storage media that are predominantly used, and perhaps 


owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is 


possible that the things described in this warrant could be found on any of those computers or 


storage media, the warrant applied for would permit the seizure and review of those items as well. 
B. Review of ESI 

73. Following seizure of any computer devices and storage media and/or the creation 
of forensic image copies, law enforcement personnel (who may include, in addition to law 
enforcement officers and agents, attorneys for the government, attorney support staff, agency 
personnel assisting the government in this investigation, and outside technical experts under 
government control) will review the ESI contained therein for information responsive to the 
warrant. 

74. Jn conducting this ER ae enforcement jaod may use various techniques 
to determine which files or other ESI contain evidence or fruits of the Subject Offenses. Such 
techniques may include, for example: 

e surveying directories or folders and the individual files they contain (analogous to 
looking at the outside of a file cabinet for the markings it contains and opening a drawer 
believed to contain pertinent files); 

e conducting a file-by-file review by “opening” or reading the first few “pages” of such 
files in order to determine their precise contents (analogous to performing a cursory 
examination of each document in a file cabinet to determine its relevance); 

e “scanning” storage areas to discover and possibly recover recently deleted data or 


deliberately hidden files; and 
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è 


e performing electronic keyword searches through all electronic storage areas to 
determine the existence and location of data potentially related to the subject matter of 
the investigation’; and 


ə reviewing metadata, system information, configuration files, registry data, and any 
other information reflecting how, when, and by whom the computer was used. 


75. Law enforcement personnel will make reasonable efforts to restrict their search to 
ia falling within the categories of evidence specified in the warrant. Depending on the 
circumstances, however, law enforcement personnel may need to conduct a complete review of all 
the ESI from seized devices or storage media to evaluate its contents and to locate all data 
responsive to the warrant. 

76. Review of the items described in Attachment A will be conducted pursuant to 
established procedures designed to collect evidence in a manner consistent with professional 
responsibility E concerning the maintenance of attorney-client and other operative 
privileges. The procedures include use of a designated “filter team,” separate and apart from the 
investigative team, in order to adress potential privileges. 


E, Return of ESI 


77, Ifthe Government determines that the electronic devices are no longer necessary 
to retrieve and preserve the data, and the devices themselves are not subject to seizure pursuant to 
Federal Rule of Criminal Procedure 41(c), the Government will return these items, upon request. 
Computer data that is encrypted or unreadable will not be returned unless law enforcement 


_ personnel have determined that the data is not (i) an instrumentality of the offense, (ii) a fruit of 


25 Keyword searches alone are typically inadequate to detect all relevant data. For one thing, keyword searches work 
only for text data, yet many types of files, such as images and videos, do not store data as searchable text. Moreover, 
even as to text data, there may be information properly subject to seizure but that is not captured by a keyword. 
search because the information does not contain the keywords being searched. 
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the criminal activity, (iii) contraband, (iv) otherwise unlawfully possessed, or (v) evidence of the 


Subject Offenses. 


IV. Conclusion and Ancillary Provisions 

78. Based on the foregoing, I respectfully request the court to issue a warrant to seize 
the items and information specified in Attachment A to this affidavit and to the Search and Seizure 
Warrant. 

79. In light of the confidential nature of the continuing investigation, I respectfully 
request that this affidavit and all papers submitted herewith be maintained under seal until the 
Court orders otherwise. Sealing is necessary because items and information to be seized are 
relevant to an ongoing investigation, and premature disclosure of the contents of this affidavit and 
related documents may have a negative impact on this continuing investigation and may jeopardize 


its effectiveness. 


Respectfully submitted, 


fl ie 


Special Agent 
Federal Bureau of Investigation 
Subscribed and sworn to before megi tiA ‘day of Tanuary, 2019. 
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THE HONORABLE ROBERT W. LEHRBURGER 


Eti 


United States Magistrate Judge 


45 


Case 1:19-mc-00029-CRC Document 29-32 Filed 04/28/20 Page 53 of 56 


ATTACHMENT A 
I. Premises to be Searched — Subject Premises 
The premises to be searched (the “Subject Premises”) are described as follows, and 


include all locked and closed containers found therein: 


The Subject Premises are particularly described a 


II. Items to Be Seized 
A. Evidence, Fruits, and Instrumentalities of the Subject Offenses 


The items to be seized from the Subject Premises include the following evidence, fruits, 
and instrumentalities of violations of (i) Title 18, United States Code, Section 1505 (obstruction 
of proceedings before departments, agencies, and committees); (ii) Title 18, United States Code, 
Section 1001 (false statements); and (iti) Title 18, United States Code, Section 1512(b)(1) (witness 
tampering); (collectively the “Subject Offenses”), for the period June 2015 to the present, 
described as follows: | 

a. Evidence concerning who occupies or owns the Subject Premises, including 
without limitation, utility and telephone bills, mail envelopes, addressed 
correspondence, diaries, statements, identification documents, address books, 
telephone directories, and keys; | 

b. Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 
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k. 


Documents that reflect communications between Roger Stone and Jerome Corsi 
that concern the Subject Offenses; 

Documents reflecting communications between Roger Stone and Randy Credico 
that concern the Subject Offenses; 

Documents reflecting communications between Roger Stone and members of the 
Trump Campaign or Trump Campaign associates, including Stephen K. Bannon, 
==. Paul eso Richard Gates, and Donald J. Trump, that concern the 
Subject Offenses; 

Documents related to or discussing investigations into Russian interference in the 
2016 U.S. presidential election and related matters by the U.S. House of 
Representatives Permanent Select Committee on Intelligence; the U.S. Senate 
Select Committee on Intelligence; and/or the Federal Bureau of Investigation; 
Records and information relating to the use, ownership, or control of e-mail 


Records and information demonstrating who uses, owns, or controls the WhatsApp 


account associated with telephone numbe fi ; 


Records and information demonstrating who uses, owns, or controls the Signal 


account associated with telephone cac j 


Records and information demonstrating who uses, owns, or controls the Wickr 


account associated with telephone De o i 


Records pertaining to accounts held with Internet Service Providers providing 


service at or to the Subject Premises; 
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1. Computers and media storage devices, including tablets/iPads, and records or 
documents demonstrating who operates, owns, or controls such devices, such as 
telephone records, notes, notebooks, diaries, and reference materials, in whatever 
form; and 

m. Cellular telephones, smartphones, or personal data assistant devices, and records or 
documents demonstrating who operates, owns, or controls such devices, such as 


telephone records, notes, notebooks, diaries, and reference materials, in whatever 


form. 
B. Search and Seizure of Electronically Stored Information 


The items to be seized from the Subject Premises also include any computer devices and 
storage media that may contain any electronically stored information falling within the categories 
set forth in Section II.A.a-k of this Attachment above, including, but not limited to, desktop and 
laptop computers, disk drives, modems, thumb drives, personal digital assistants, smart phones, 
digital cameras, and scanners. In lieu of seizing an such computer devices or storage media, this 
watrant also authorizes the copying of such devices or media for later review. 


The items to be seized from the Subject Premises also include: 


1. Any items or records needed to access the data stored on any seized or copied 
computer devices or storage media, including but not limited to any physical keys, encryption 
devices, or records of login credentials, passwords, private encryption keys, or similar information. 


2 Any items or records that may facilitate a forensic examination of the computer 
devices or storage media, including any hardware or software manuals or other information 
concerning the configuration of the seized or copied computer devices or storage media. 


3. Any evidence concerning the identities or locations of those persons with access to, 
control over, or ownership of the seized or copied computer devices or storage media. 


C. Review of ESI 


_ Following seizure of any computer devices and storage media and/or the creation of 
forensic image copies, law enforcement personnel (who may include, in addition to law 
enforcement officers and agents, attorneys for the government, attorney support staff, agency 
personnel assisting the government in this investigation, and outside technical experts under 
government control) are authorized to review the ESI contained therein for information 
responsive to the warrant. 
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In conducting this review, law enforcement personnel may use various techniques to 
locate information responsive to the warrant, including, for example: 


surveying various file “directories” and the individual files they contain (analogous to 
looking at the outside of a file cabinet for the markings it contains and opening a drawer 
believed to contain pertinent files); . 


opening or cursorily reading the first few “pages” of such files in order to determine 
their precise contents; 


scanning storage areas to discover and possibly recover recently deleted files or 
deliberately hidden files; 


performing key word searches through all electronic storage areas to determine whether 
occurrences of language contained in such storage areas exist that are intimately related 
to the subject matter of the investigation; and 


reviewing metadata, system information, configuration files, registry data, and any 
other information reflecting how, when, and by whom the computer was used. 


Law enforcement personnel will make reasonable efforts to search only for files, 
documents, or other electronically stored information within the categories identified in Sections 
Il.A.a-k and II.B of this Attachment. However, law enforcement personnel are authorized to 
conduct a complete review of all the ESI from seized devices or storage media if necessary to 
evaluate its contents and to locate all data responsive to the warrant. 
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AO 93 (Rev. 12/09) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
Southern District of Florida 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


Case No,  19-6033-SNOW 


, Fort Lauderdale, Florida [J (further 
described in Attachment "A") 


SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Southern District of Florida 
(identify the person or describe the property to be searched and give its location): 


HE © ot Lauderdale, Florida J) (further described in Allachment "A") 


The person or property to be searched, described above, is believed to conceal (identify the person or describe the 
property to be seized): 


See Attachment "B." 


l find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 
property. 


YOU ARE COMMANDED to execute this warrant on or before Feb AT. LO í j 
(not a exceed 14 days) 


Mi in the daytime 6:00 a.m. to 10 p.m. O at any time in the day or night as I find reasonable cause has been 
established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge 
Lurana S. Snow 


(name) 


O I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be 
searched or seized (check the appropriate box) O for days (not to exceed 30). 


ESS O until, the facts justifying, the later specific date of 


Date and time issued: 4} ou] 14 f: aS (Joes J, p 75 
PR 


Judge's signature 


City and state: Fort Lauderdale, Florida Lurana S. Snow, United States Magistrate Judge 
i Printed name and title 
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ATTACHMENT A 


The address of the I, fort Lauderdale, Florida yyy 


Two photographs of the exterior of the Subject Premises are attached below. 
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ATTACHMENT B 


Property to be seized from the Subject Premises 


The items to be seized are fruits, evidence, information relating to, contraband, or 


instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of 


proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 


United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for 


the time period June 2015 to the present, including: 


a. 


Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 
Documents reflecting communications between Stone and Jerome Corsi; 
Documents reflecting communications between Stone and Randy Credico; 
Documents reflecting communications between Stone and members of the Trump 
Campaign or Trump Campaign associates, including Steve Bannon S. 
Paul Manafort, Richard Gates, and Donald J. Trump; 

Documents related to or discussing the U.S. House of Representatives Permanent 
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or 


the Federal Bureau of Investigation; 


Records and information relating to the e-mail account: ii 
and 


Records and information relating to the WhatsApp account associated with 


telephone number I; 


Records and information relating to the Signal account associated with telephone 


number as: 
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A 


Records and information relating to the Wickr account associated with telephone 
number a. 

Any computers, media storage devices, tablets/iPads, cellular telephones, 
smartphones, personal data assistant devices, or other electronic devices used to 
commit the violations described above or to store records or documents described 
above; 

Records of personal and business activities relating to the operation and 
ownership of the computer systems, such as telephone records, notes, notebooks, 
diaries, and reference materials, in whatever form; 

Records pertaining to accounts held with Internet Service Providers or of Internet 
use, in whatever form; 


For any computer or storage medium whose seizure is otherwise authorized by 


this warrant, and any computer or storage medium that contains or in which is stored records or 


information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 


a. 


evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, documents, 
browsing history, user profiles, email, email contacts, “chat,” instant messaging 
logs, photographs, and correspondence; 

evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 


software; 
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c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events relating 
to crime under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime 
under investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 

g. evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’s Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 
records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 


attachment. 
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AO 93 (Rev. 12/09) Search and Seizure Warrant (Page 2) 


Return 


Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized: 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original 
warrant to the designated judge. 


Executing officer's signature 


Printed name and title 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT 


for the 
Southern District of Florida 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


- BR, Font Lauderdale, Florida QJ (further described in 


Attachment "A") 


Case No. 19-6033-SNOW 


ee Ee EOE 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that | have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


HS Fort Lauderdale, Florida J (further described in Attachment "A") 


located in the Southern District of Florida , there is now concealed (identify the 
person or describe the property to be seized): 


See Attachment "B." 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
Wf evidence of a crime; 
W contraband, fruits of crime, or other items illegally possessed; 
AÍ property designed for use, intended for use, or used in committing a crime; 
O a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


| Code Section Offense Description 
f 18 U.S.C. 1505 Obstruction of Proceeding 

| 18 U.S.C. 1001 False Statements 

| 18 U.S.C. 1512(b)(1) Witness Tampering 


| The application is based on these facts: 
see attached affidavit. 


wh Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Chin A. AEPA 


Applicant’s signature 


Curtis A. Heide, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


Date: Jau] 19 i pi - e. a 


Judge's signature 


City and state: Fort Lauderdale, Florida Lurana S. Snow, United States Magistrate Judge 
Printed name and title 
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ATTACHMENT A 


The address of the Subject Premises is J Fort Lauderdale, Florida I 
ss] 


Two photographs of the exterior of the Subject Premises are attached below. 
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ATTACHMENT B 
Property to be seized from the Subject Premises 
l. The items to be seized are fruits, evidence, information relating to, contraband, or 
instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of 
proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 
United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for 
the time period June 2015 to the present, including: 
a. Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 
b. Documents reflecting communications between Stone and Jerome Corsi; 
c. Documents reflecting communications between Stone and Randy Credico; 
d. Documents reflecting communications between Stone and members of the Trump 
Campaign or Trump Campaign associates, including Steve Bannon, B. 
Paul Manafort, Richard Gates, and Donald J. Trump; 
e. Documents related to or discussing the U.S. House of Representatives Permanent 
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or 


the Federal Bureau of Investigation; 


f. Records and information relating to the e-mail accounts 
and S; 


g. Records and information relating to the WhatsApp account associated with 


telephone number QA: 


h. Records and information relating to the Signal account associated with telephone 


number is: 
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i. Records and information relating to the Wickr account associated with telephone 
number a. 

j. Any computers, media storage devices, tablets/iPads, cellular telephones, 
smartphones, personal data assistant devices, or other electronic devices used to 
commit the violations described above or to store records or documents described 
above; 

k. Records of personal and business activities relating to the operation and 
ownership of the computer systems, such as telephone records, notes, notebooks, 
diaries, and reference materials, in whatever form; 

l. Records pertaining to accounts held with Internet Service Providers or of Internet 
use, in whatever form; 

2. For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, documents, 
browsing history, user profiles, email, email contacts, “chat,” instant messaging 
logs, photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 


software; 
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evidence of the lack of such malicious software; 

evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events relating 
to crime under investigation and to the computer user; 

evidence indicating the computer user’s state of mind as it relates to the crime 
under investigation; 

evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 

evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

evidence of the times the COMPUTER was used; 

passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

records of or information about Internet Protocol addresses used by the 
COMPUTER; 

records of or information about the COMPUTER’s Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 


records of user-typed web addresses; 


. contextual information necessary to understand the evidence described in this 


attachment. 
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AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

L, I make this affidavit in support of an application for a search warrant for the 
premises known and described as J Fort Lauderdale, Florida, J described in 
the following paragraphs and further in Attachment A. 

2. J am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have 
been since 2006. In the course of my duties, I have been responsible for investigating federal 
crimes and national security matters involving both counterintelligence and issues related to 
cybersecurity. 

3. I am currently involved in the investigation into Roger Jason Stone, Jr., (“Roger 
Stone”) and others known and unknown to the government, for the commission of unlawful 
activities in the Southern District of Florida, and elsewhere, including, but not limited to: (i) 
obstruction of proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false 
statements, in violation of Title 18, United States Code, Section 1001 and (iii) witness tampering, 
in violation of Title 18, United States Code 1512(b)(1) (collectively the “Specified Federal 
Offenses”), 

4. I have personally participated in this investigation and am aware of the facts 
contained herein based on my own investigation, as well as my review of documents, records, 
and information provided to me by other law enforcement officers and technical experts. 

5. This affidavit is intended to show merely that there is sufficient probable cause 
for the requested warrant and does not set forth all of my knowledge about this matter. Unless 


specifically indicated, all conversations and statements in this affidavit are related in substance 
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and part. Where I assert that an event took place on a particular date, I am asserting it took place 
on or about the date specified. 

6. I make this affidavit in support of an application for a warrant to search the 
premises located at (MJ, Fort Lauderdale, FL (the “Subject Premises,” as is more 
particularly described in Attachment A), in connection with the Specified Federal Offenses, for 
the items enumerated in Attachment B, which constitute evidence, contraband, fruits, and 
instrumentalities of the Specified Federal Offenses. 

T: For the reasons set forth in this Affidavit, there is probable cause to believe that 
one or more of the Specified Federal Offenses have been committed by Roger Stone and others 
known and unknown to the government. Further, there is probable cause to believe the Subject 
Premises have been used to facilitate the commission of one or more of the Specified Federal 
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and 
instrumentalities of violations of the Specified Federal Offense may be present in the Subject 
Premises. 

PROBABLE CAUSE 
A. Background on Relevant Individuals 

8. Roger Stone is a political consultant who has worked for decades in U.S. politics 
and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of 
Donald J. Trump (“Trump Campaign”) until in or around August 2015, and subsequently 
maintained regular contact with and publicly supported the Trump Campaign through the 2016 
election. 

9. Julian Assange is the founder and director of WikiLeaks, which is publicly 


described as a non-profit organization that disseminates non-public information and classified 
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media provided by anonymized sources. WikiLeaks has posted numerous documents stolen from 
the U.S. government. At all relevant times, Assange was located at the Ecuadorian Embassy in 
London, United Kingdom. 

10. Jerome Corsi is a political commentator who worked with an online media 
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi spoke 
regularly with Stone throughout the campaign, including about the release of stolen documents 


by WikiLeaks. 


12. Based on the investigation to date, Randy Credico was a radio host who has 


known Stone for more than a decade. In testimony before the U.S. House of Representatives 
Permanent Selection Committee on Intelligence (““HPSCI’’) on or about September 26, 2017, 


99 66 


Stone described Credico (without naming him) as an “intermediary,” “go-between,” and “mutual 
friend” to Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified 
Credico by name and claimed Credico was the “gentleman who confirmed for Mr. Stone” that 
Assange, had “‘[e]mails related to Hillary Clinton which are pending publication.’” 

13. Richard Gates is a U.S. citizen who served for years as a political consultant and 
lobbyist along with Paul Manafort. From in or around June 2016 until November 2016, Gates 
served as the deputy campaign chairman of the Trump Campaign. On February 23, 2018, Gates 


pled guilty to one count of conspiracy against the United States and one count of making false 


statements to federal law enforcement officers. United States v. Gates, 1:17-cr-201 (D.D.C.). 


Page 3 of 42 


Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 15 of 53 


14. Steve Bannon is a U.S. citizen who serves as a political consultant. Beginning in 


or around August 2016 and through the 2016 U.S. presidential election, Bannon served as the 


chief executive officer of the Trump Campaign. 


B. Hacking Activity During the 2016 Presidential Election 

16. John Podesta is a U.S. citizen who served for years as a political consultant. 
During the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the 
Hillary Clinton presidential campaign (“Clinton Campaign”). On or about March 24, 2016, 
Podesta received a spearphishing' email designed to appear as a security notification (a partial 
copy of the email was recovered by the FBI from a subsequent release of stolen emails, 
described below). During an interview with the FBI in or around May 2018, Podesta indicated 
that after receiving the email, his assistant (who also had access to the account) clicked on a link 
within the email and entered the account password when prompted (believing this prompt to be 
part of a security protocol). Based on my training and experience, this activity appears to have 
been a successful spearphishing operation through which an actor would have gained access to 
Podesta’s email account allowing the actor to steal emails and documents from that account. 

he The Democratic National Committee (‘DNC”) and Democratic Congressional 


Campaign Committee (“DCCC”) are U.S. political committees focusing on U.S. federal 


' In my training and experience, spearphishing in this context refers to the fraudulent practice of 
sending an email that purports to be from a known or trusted sender in order to induce the 
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL. 
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elections. Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including 
the 2016 U.S. presidential election. According to DNC and DCCC individuals interviewed by 
the Special Counsel’s Office, in or around the spring of 2016, the DNC and DCCC became 
aware that their computer systems had been compromised by unauthorized intrusions and hired 
the cybersecurity company CrowdStrike to investigate the intrusions and remediate. 

18. On or about June 14, 2016, CrowdStrike issued a public press release announcing 
that the DNC’s computer network had been compromised. In the public statement, CrowdStrike 
indicated that it had identified “two sophisticated adversaries on the network,” which it referred 
to by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously 
seen these actors target other customers and that, based on their experience, “[b]oth adversaries 
engage in extensive political and economic espionage for the benefit of the government of the 
Russian Federation and are believed to be closely linked to the Russian government’s powerful 
and highly capable intelligence services.” 

19. On or about July 13, 2018, a federal grand jury sitting in the District of Columbia 
returned an indictment against eleven Russian nationals, charging them with partaking in a 
conspiracy to hack into, among other things, the email account of John Podesta, as well as the 
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1:18-cr-215 
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in 
the Main Intelligence Directorate of the General Staff (“GRU”), the Russian Federation’s 
military intelligence agency. 

C. WikiLeaks’ Release of Stolen Documents During the 2016 Presidential Campaign 

20. As alleged in the Netyksho indictment, after successfully hacking the DNC and 


DCCC networks, as well as Podesta’s email account, GRU officers transmitted some of the 
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stolen documents to WikiLeaks. GRU officers communicated with WikiLeaks members about 
the transfers using online personas created by the GRU, including “Guccifer 2.0” and 
“DCLeaks.” (GRU officers separately used these personas to release some of the stolen 
documents). 

21. On or about July 22, 2016, WikiLeaks released tens of thousands of documents 
stolen from the DNC network. These stolen documents included communications by senior 
DNC officials about campaign strategy, financial and fundraising data, and other documents 
related to the 2016 U.S. federal elections, including the 2016 U.S. presidential election. 

22. Beginning in or around October 2016, WikiLeaks began to release tens of 
thousands of emails and documents stolen from Podesta’s email account. Between on or about 
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of 
documents that had been stolen from John Podesta, releasing a total of over 50,000 documents. 

D. Stone’s Communications About WikiLeaks During the Campaign 

23. In April 2018 interviews with the Special Counsel’s Office, Gates stated that 
starting in or around May 2016, when Gates was a senior official on the Trump campaign, Stone 
informed members of the Trump Campaign that WikiLeaks had emails from then-candidate 
Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC emails by 
WikiLeaks, Gates observed a conversation between Manafort and Stone in which they discussed 
WikiLeaks and Stone’s prediction of the release. 

24. According to Gates, Manafort directed Gates to contact Stone about any 
additional releases and what other information WikiLeaks had regarding the Clinton Campaign. 
Gates contacted Stone, who made statements claiming that there would be potential future 


releases of damaging material by WikiLeaks. In a separate interview with the Special Counsel’s 
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Office in or around October 2018, Gates recalled that at one point during the campaign he was 
with then-candidate Trump in a car when the candidate had a telephone call with Stone; shortly 
after finishing the call with Stone, Gates recalled then-candidate Trump said more leaks were 
coming. 

25. Emails recovered through a court-authorized search of Stone’s email account 
GEE show that shortly after the July 22, 2016 release of stolen DNC emails 
by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to 
obtain other emails damaging to the Clinton Campaign: 

a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject 
line, “Get to Assange.” The body of the message read: “Get to Assange [a]t 
Ecuadorian Embassy in London and get the pending WikiLeaks emails... they 
deal with Foundation, allegedly.” On or about the same day, Corsi forwarded 
Stone’s email to J, who lived in the United Kingdom and was a supporter 
of the Trump Campaign. 

b. On or about July 31, 2016, Stone emailed Corsi with the subject line, “Call me 
MON.” The body of the email read in part that {J “should see Assange.” 

c. On or about August 2, 2016, Corsi responded to Stone by email and wrote that he 
was currently in Europe and planned to return in mid-August. Corsi stated, “Word 


> A search of { was authorized on or about September 11, 2017 by the 
U.S. District Court for the District of Columbia. Case No. 1:17-mj-661 (D.D.C. Sept. 11, 2017). 


A second search of I was authorized on or about August 3, 2018 by the 
U.S. District Court for the District of Columbia. Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). 
On or about September 26, 2018, the government obtained and executed an order pursuant to 18 
U.S.C. § 2703(d) for records connected to NM. Case No. 1:18-sc-2911 
(D.D.C. Sept. 26, 2018). Records provided in response by Microsoft Corporation confirmed that 
the account was still active and that the relevant emails described in this affidavit were not 
deleted from the account. 
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26. 


is friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in Oct. 
Impact planned to be very damaging.” In a law enforcement interview, Corsi 
stated that the phrase “friend in embassy” referred to Assange. Corsi added in the 
same email, “Time to let more than Podesta to be exposed as in bed w enemy if 
they are not ready to drop HRC. That appears to be the game hackers are now 
about. Would not hurt to start suggesting HRC old, memory bad, has stroke — 
neither he nor she well. I expect that much of next dump focus, setting stage for 
Foundation debacle.” 


According to recorded public statements recovered by the FBI, starting in early 


August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated 


statements about information he claimed to have learned from Assange: 


a. 


According to a public video posted to YouTube, on or about August 8, 2016, 
Stone attended a public event in Broward County, Florida. During the event, 
Stone stated, “I actually have communicated with Assange. I believe the next 
tranche of his documents pertain to the Clinton Foundation, but there’s no telling 
what the October surprise may be.” 

According to a public video posted to YouTube, on or about August 12, 2016, 
Stone was interviewed for a video segment on the show InfoWars, hosted by Alex 
Jones. During the interview, Stone stated that he was “in communication with 
Assange” but was “not at liberty to discuss what I have.” 

According to a public video posted to YouTube, on or about August 16, 2016, 
Stone stated during another interview with Alex Jones that “it became known on 


this program that I have had some back-channel communication with WikiLeaks 
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zd. 


and Assange.” In a second interview on or about the same day with Dana Loesch 
of the TheBlaze TV, Stone stated that he “communicated with Mr. Assange” and 


that they had a “mutual acquaintance who is a fine gentleman.” 


. According to a video posted to the public website of the TV station C-SPAN, 


during a C-SPAN television interview on or about August 18, 2016, Stone stated 
that he had communicated with Assange through an “intermediary, somebody 
who is a mutual friend.” 

In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio 
interview he did with Stone on or about August 23, 2016 during which the two 
discussed Stone’s prior claims to be in contact with Assange. At one point during 
the interview, Credico asked Stone, “You’ve been in touch indirectly with 
Assange. Can you give us any kind of insight? Is there an October surprise 
happening?” Stone responded, “Well, first of all, I don’t want to intimate in any 
way that I control or have influence with Assange because I do not.... We have 
a mutual friend, somebody we both trust and therefore I am a recipient of pretty 


good information.” 


In or around November 2018, (I. Stone 


produced a series of text messages between Stone and Credico during the 2016 presidential 


campaign.’ These text messages show that beginning on or about August 19, 2016, Stone 


exchanged written communications with Credico about what WikiLeaks and Assange planned to 


do. Emails recovered through a court-authorized search of Stone’s email account 


3 As discussed below, Stone had previously released some of these text messages to members of 
the media, who had written about them and published them in part. 
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SE show additional written communications between Stone and Credico 
about WikiLeaks in or around September 2016. 

a. On or about August 19, 2016, Credico sent a text message to Stone that read in 
part, “I’m going to have Julian Assange on my show next Thursday.” On or 
about August 21, 2016, Credico sent another text message to Stone, writing in 
part, “I have Julian Assange on Thursday so I’m completely tied up on that day.” 

b. On or about August 25, 2016, Assange was a guest on Credico’s radio show for 
the first time. On or about August 26, 2016, Credico sent a text message to Stone 
that stated, “Assange talk[ed] about you last night.” Stone replied and asked what 
Assange said, to which Credico responded, “He didn’t say anything bad we were 
talking about how the Press is trying to make it look like you and he are in 
cahoots.” 

c. On or about August 27, 2016, Credico sent text messages to Stone that said, “We 
are working on a Julian Assange radio show,” and that he (Credico) was “in 
charge” of the project. In a text message sent later that day, Credico added, 
“Julian Assange has kryptonite on Hillary.” 

d. On or about September 18, 2016, Stone sent a text message to Credico that said, 
“I am e-mailing u a request to pass on to assange.” Credico responded “Ok,” and 
added in a later text message, “Just remember do not name me as your connection 
to Assange you had one before that you referred to.” 

e. Later on or about September 18, 2016, Stone emailed Credico an article with 
allegations against then-candidate Clinton related to her service as Secretary of 


State. Stone stated, “Please ask Assange for any State or HRC e-mail from 
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August 10 to August 30 -- particularly on August 20, 2011 that mention [the 
subject of the article] or confirm this narrative.” 

f. On or about September 19, 2016, Stone texted Credico again, writing, “Pass my 
message .. . to Assange.” Credico responded, “I did.” On or about September 
20, 2016, Credico forwarded the request to a close friend who was an attorney 
with the ability to contact the Assange. Credico blind-copied Stone on the 
forwarded email. 

g. On or about September 30, 2016, Credico sent Stone via text message a 
photograph of Credico standing outside the Ecuadorian Embassy in London 
where Assange was located. 

h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text 
messages that stated, “big news Wednesday ... now pretend u don’t know me... 
Hillary’s campaign will die this week.” In the days preceding these messages, the 
press had reported that Assange planned to make a public announcement on or 
about Tuesday, October 4, 2016, which was reported to be the 10-year 
anniversary of the founding of WikiLeaks. 

i. On or about October 2, 2016, Stone emailed Credico, with the subject line 
“WTF?” and a link to an article at the website http://heatst.com/politics/october- 
surprise-thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement- 
due-to-security-concerns. Credico responded to Stone, “head fake.” 

j. On or about Monday, October 3, 2016, Stone wrote Credico and asked, “Did 
Assange back off.” Credico initially responded, “I can’t tal[k] about it.” After 


further exchanges with Stone, Credico responded, “I think itP]s on for 
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28. 


tomorrow.” Credico added, “Off the Record Hillary and her people are doing a 
full-court press they [sic] keep Assange from making the next dump .. . That’s all 
I can tell you on this line . . . Please leave my name out of it.” 


Emails and text messages recovered by the FBI show that, in or around October 


2016, Stone made statements about Assange’s future releases that were similar to prior 


statements Credico made to him. For example: 


4 A search of 


a. In acourt-authorized search of Stone’s email accoun{ the 


FBI recovered an email from Stone to {J sent on or about October 3, 2016, 
which stated in part, “Spoke to my friend in London last night. The payload is 
still coming.” 

In a court-authorized search of I. the FBI also recovered an 
email exchange from on or about October 3, 2016 between Stone and a reporter 
who had connections to Bannon. In the exchange, the reporter asked, “Assange — 
what’s he got? Hope it’s good.” Stone responded, “It is. I’d tell Bannon but he 
doesn’t call me back.” 

On or about October 4, 2016, Assange held a press conference but did not release 
any new materials pertaining to the Clinton Campaign. In a court-authorized 
search of I, the FBI recovered an email exchange between 
Stone and Steve Bannon on or about October 4, 2016 that occurred after the press 
conference. In the exchange, Bannon asked, “What was that this morning???,” 
referring to Assange’s press conference. Stone responded, “Fear. Serious security 


was authorized on or about October 17, 2017 by the U.S. 


District Court for the District of Columbia. Case No. 1:17-mj-760 (D.D.C. Oct. 17, 2017). A 
second search of MG was authorized on or about August 3, 2018 by the U.S. 
District Court for the District of Columbia. Case No. 1:18-sc-2583 (D.D.C. Aug. 3, 2018). 
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concern. He thinks they are going to kill him and the London police are standing 
do[wn]. However — a load every week going forward.” 

d. In a court-authorized search of Stone’s iCloud account,’ the FBI recovered text 
messages between Stone and {J from on or about October 4, 2016. In one 
text message, MJ asked Stone if he had “hear[d] anymore from London.” 
Stone replied, “Yes — want to talk on a secure line — got Whatsapp.” In an 
interview with the Special Counsel’s Office in or around May 2018, BEE 
confirmed that he and Stone spoke and that Stone had told him WikiLeaks had 
more material to release, and that the material was related to senior people 
associated with Clinton. 

29. On or about October 7, 2016, WikiLeaks released the first set of emails stolen 
from Podesta. According to text messages recovered from Stone’s iCloud account, shortly after 
the release, an associate of Bannon sent a text message to Stone that read, “well done.” 
Similarly, during an April 2018 interview, Gates recalled that after the October 7, 2016 


WikiLeaks release, Stone said, “I told you this was coming.” 


E. Stone’s Communications with the House Permanent Select Committee on 
Intelligence 


30. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating 
allegations of Russian interference in the 2016 presidential election and possible links to 


individuals associated with political campaigns.° During a public HPSCI hearing on or about 


5 A search of Stone’s iCloud account was authorized on or about March 14, 2018 by the U.S. 
District Court for the District of Columbia. Case No. 1:18-sc-662 (D.D.C. Mar. 14, 2018). The 
records for Stone’s iCloud account contained some, but not all, of Stone’s communications from 
the campaign period. 


é On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee 
on Intelligence (‘SSCP’) announced the committee would conduct an inquiry that would 


Page 13 of 42 


a . Case 1:19-mc-00029-CRC Document 29-33 Filed 04/28/20 Page 25 of 53 


March 20, 2017, multiple HPSCI committee members indicated that Stone’s prior public 
statements about having communications with Assange (particularly those from August 2016) 
were of interest to the committee. 

31, In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily 
appear before the committee and produce relevant documents to HPSCI (a copy of the HPSCI 
letter was recovered by the FBI from a court-authorized search of Stone’s email account 


E) The letter requested Stone produce: 


Any documents, records, electronically stored information 
including e-mail, communication, recordings, data and tangible 
things (including, but not limited to, graphs, charts, photographs, 
images and other documents) regardless of form, other than those 
widely available (e.g., newspaper articles) that reasonably could 
lead to the discovery of any facts within the investigation's 
publicly-announced parameters. 


32. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and 
stated, “Mr. Stone has no documents, records, or electronically stored information, regardless of 
form, other than those widely available that reasonably could lead to the discovery of any facts 
within the investigation’s publicly-announced parameters.” (A copy of the letter was recovered 
from a court-authorized search of Stone’s email account [a ). 

F. Stone’s Testimony Before HPSCI 

33. On or about September 26, 2017, Stone provided HPSCI with an “opening 

statement” that his counsel requested be included as part of the record of proceedings before 


HPSCI. In his opening statement, which HPSCI provided to the Department of Justice,” Stone 


investigate, among other things, any intelligence regarding links between Russia and individuals 
associated with political campaigns, as well as Russian cyber activity and other “active 
measures” directed against the United States in connection with the 2016 election. 


7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of 
Stone’s interview with HPSCI, as well as any written submissions and/or correspondence from 
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stated, “These hearings are largely based on a yet unproven allegation that the Russian state is 
responsible for the hacking of the DNC and John Podesta and the transfer of that information to 
WikiLeaks.” 

34. Also on or about September 26, 2017, Stone provided testimony in a closed 
session before HPSCI, at the U.S. Capitol in Washington, D.C. Stone’s testimony was 
transcribed, and a copy of the transcript was obtained by the Department of Justice from HPSCI 
in or around December 2018. Stone appeared before HPSCI under oath and affirmed for the 
record that he would tell the truth. At the beginning of the hearing, Stone was admonished that 
“it is unlawful to deliberately provide false information to Members of Congress or staff” and 
that “providing false information to this committee or concealing material information from this 
committee is a crime punishable by law.” 

Stone ’s Testimony About Documents He Possessed Related to WikiLeaks 

35. During his HPSCI testimony, Stone was asked about HPSCI’s May 2017 
document request and whether Stone had any documents or written communications that 
discussed Julian Assange, Russian interference, or other relevant documents: 

Q: The committee wrote to you on May 9th requesting no later 
than May 22 any documents, records, electronically stored 
information, including email communication, recordings, 
data, and other tangible things relevant to our investigation. 
You wrote back through counsel that you had no 
documents, records, or electronically stored information 


regardless of form responsive to our requests. Was that a 
false statement? 


A: That is not a false statement. That’s what -- I believe that 
to be true. 


Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI 
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017 
interview of Roger Stone, a copy of Stone’s written opening statement, and various 
correspondence from Stone’s counsel to members of HPSCI. 
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Q: So you have no emails to anyone concerning the allegations 
of hacked documents or your conversations with the 
Guccifer 2[.0] or any discussions you have had with third 
parties about Julian Assange? You have no emails, no texts, 
no documents whatsoever, any kind of that nature? 


A: That is correct. Not to my knowledge. I think we met, 
again, the precise criteria of your request, and we complied. 
Again, if you have a more specific request, I'm happy to go 
back and look. ... 


I just want to ask you under oath — 


A: We did an extensive search consistent with the direction of 
my attorneys, and we found nothing that met the criteria 
that you asked for. 

Q: I just want to be certain because you are under oath, where 


your letter was not under oath, that you have no documents, 
no emails, no texts, no tweets that refer to Julian Assange 
or Guccifer 2[.0] or Paul Manafort or the allegations 
concerning Russian connections with the campaign. You 
have had no discussions in any written form. You've 
written no documents yourself, 


REM 


A: In connection with Russian collusion, consistent with your 
exact and precise request, yes. 


36. In fact, and as described above, Stone had sent and received numerous emails and 


text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and 


WikiLeaks possession of hacked emails. Court-authorized searches of Stone’s email accounts 


(inching a) 2nd his iCloud account show 


that, at the time of his testimony, Stone was still in possession of many of these emails and text 


ee 


messages at the time he testified on or about September 22, 2017.8 These written 


? The warrant for Stone’s email account |) was obtained on or about 


September 11, 2017 and executed shortly thereafter. Records provided in or around September 
2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the 
account was active and the emails in question were not deleted from the account. The warrant 
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communications included (a) Stone’s email to Corsi on or about July 25, 2016, that read in part, 
“Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails... 
they deal with Foundation, allegedly.”; (b) Stone’s email to Corsi on or about July 31, 2016 that 
Malloch “should see Assange”; (c) Corsi’s email to Stone on or about August 2, 2016 that stated 
in part: “Word is friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in 
Oct. Impact planned to be very damaging.”; (d) dozens of text messages and emails between 
Stone and Credico, beginning on or about August 19, 2016 and continuing through duration of 
the election, in which they discussed WikiLeaks and Assange; (e) Stone’s email to J on or 
about October 3, 2016 that read in part “Spoke to my friend in London last night. The payload is 
still coming.”; and (f) Stone’s email to Bannon on or about October 4, 2016 that claimed 
WikiLeaks would release “a load every week going forward.” 
Stone ’s Testimony About His Early August 2016 Statements 

37. During his HPSCI testimony on or about September 26, 2017, Stone was asked to 
explain his statements in early August 2016 about being in contact with Assange. Stone was 
specifically asked about his statement on or about August 8, 2016 that “I’ve actually 
communicated with Assange,” as well as his statement on or about August 12, 2016 that he was 
“in communication with Assange” but was “not at liberty to discuss what I have.” 

38. Stone testified that these public references to having a means of contacting 
WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a “go- 
between, as an intermediary, as a mutual friend” of Assange. Stone declined to tell HPSCI the 
name of this “intermediary,” but he provided a description in his testimony that was largely 
for Stone’s email account [I was obtained on or about October 17, 2017 and 
executed shortly thereafter. The warrant for Stone’s iCloud account (which contained the text 


messages described above) was obtained on or about March 14, 2018 and executed shortly 
thereafter. 
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consistent with Credico, (On or about October 13, 2017, Stone caused a letter to be submitted to 
HPSCI that identified Credico by name as the “gentleman who confirmed for Mr, Stone” that 
Assange had “‘[e]mails related to Hillary Clinton which are pending publication.’”). 

39. In fact, documents recovered during the investigation (including those obtained 
via search warrant returns = = 4 show that Stone did not begin 
communicating with Credico about Assange or WikiLeaks until on or about August 19, 2016°— 
approximately eleven days after Stone first claimed on or about August 8, 2016 to “actually have 
communicated with Assange” and a week after his August 12, 2016 statements of being “in 
communication with Assange” and “not at liberty to discuss what [ have.” 

40, When interviewed by the FBI, Credico stated that the first time he ever spoke 
with Assange was on or about August 25, 2016, when Credico interviewed Assange.'° Credico 
also provided the FBI with partially redacted emails that he claimed were between he and 
another member of WikiLeaks from on or about August 25, 2016, in which the two discuss the 
technical logistics for the interview later that day. During the exchange, Credico offered 
biographical information about himself, apparently as a means of introduction. 

41. | The FBI has not identified any communications between Stone and Credico from 
August 2016 in which Stone directs Credico to contact. Assange or WikiLeaks. When 
interviewed by the FBI, Credico claimed he was never directed by Stone in August 2016 to 


contact WikiLeaks. 


? As described above, on or about August 19, 2016, Credico informed Stone by text message that 
Credico intended to interview Assange the following week. On or about August 25, 2016, 
Credico interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico 
texted Stone that “Assange has kryptonite on Hillary.” 


'° Credico was first interviewed by the FBI in or around August 2018. He has subsequently 
articipated in multiple voluntary interviews. 
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42. In contrast, and as described above, the FBI has identified written 
communications prior to August 8, 2016 in which Stone directed Corsi—not Credico—to contact 
Assange. On or about July 25, 2016, for example, Stone wrote to Corsi, “’Get to Assange [alt 
Ecuadorian Embassy in London and get the pending WikiLeaks emails . . . they deal with 
Foundation, allegedly.” Similarly, on or about August 2, 2016, Corsi—not Credico—sent an 
email to Stone in which Corsi wrote that “[w]ord is friend in embassy plans 2 more dumps,” 
including one in October. These communications occurred days before Stone’s first public 
statement on or about August 8, 2016 claiming to be in communication with Assange. However, 
at no time did Stone identify Corsi to HPSCI as another individual Stone contacted to serve as a 
“go-between,” “intermediary,” or other source for information from WikiLeaks. Similarly, 
Stone also never disclosed his written communications with Corsi to HPSCI when answering 
HPSCI’s questioning about the August 8, 2016 and August 12, 2016 statements about being in 


communication with Assange. 


Stone’s Testimony About Communications to Assange 


43. During his HPSCI testimony, Stone was asked, “Did you ask [the intermediary] to 
communicate anything else to Assange?” Stone responded, “I did not.” Stone was then asked, 
“Did you ask [the intermediary] to do anything on your own behalf?” Stone responded, “I did 
not.” 

44, In fact, starting on or about September 18, 2016, Stone directed Credico to pass 
on a request to Assange for documents that Stone believed would be damaging to the Clinton 
Campaign. 


a. According to text messages MII, on or abont 


September 18, 2016, Stone sent a text message to Credico that said, “I am e- 
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mailing u a request to pass on to Assange.” On or about the same day, Stone 
emailed Credico an article with allegations against then-candidate Clinton related 
to her service as Secretary of State. Stone added, “Please ask Assange for any 
State or HRC e-mail from August 10 to August 30 — particularly on August 20, 
2011 that mention [the subject of the article] or confirm this narrative.” (A copy 
of this email was obtained through a search of Stone’s email account 
O. 

b. According to text messages E o or about 


September 19, 2016, Stone texted Credico again, writing “Pass my message . . . to 
Assange.” Credico responded, “I did.” An email obtained from the account 
SE shows that on or about September 20, 2016, Credico 
forwarded the request to an attorney who had the ability to contact Assange; 
Credico blind copied Stone on the same email. 
Stone's Testimony About Written Communications with Credico 
45. During his HPSCI testimony, Stone was asked repeatedly about his 
communications with the person he identified as his intermediary. Stone stated that he had never 
communicated with his intermediary in writing in any way. During one exchange, Stone claimed 
only to have spoken with the intermediary telephonically: 
Q: [H]ow did you communicate the intermediary? 
A: Over the phone. 


Q: And did you have any other means of communicating with 
the intermediary? 


No. 


No text messages, no — none of the list, right? 
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A: No. 
Later during his testimony, Stone again denied ever communicating with his intermediary in 
writing: 


Q: So you never communicated with your intermediary in 
writing in any way? 


No. 
Never emailed him or texted him? 


He’s not an email guy. 


Q F Q È 


So all your conversations with him were in person or over 
the phone. 


A: Correct. 

46. As described above, Stone and Credico (whom Stone identified as his 
intermediary) engaged in frequent written communication by email and text message. Beginning 
on or about August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone 
and Credico engaged in dozens of communications by email or text message in which they 
discussed WikiLeaks and the possible release of stolen documents that would be damaging to the 
Clinton Campaign. 

47. Written communications between Stone and Credico continued up until Stone’s 
HPSCI testimony and afterwards. For example, on or about September 26, 2017—the day that 
Stone testified before HPSCI and denied having ever sent or received emails or text messages 
from his identified intermediary, Stone and Credico exchanged over thirty text messages. 

48. Certain of the electronic messages between Stone and Credico (which Stone 
denied ever taking place or possessing) would have been material to HPSCI, including Stone’s 
messages in or around September 2016 directing Credico to pass a request for documents to 


Assange, and other relevant written communications with Credico. For example, on or about 
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January 6, 2017, Credico sent Stone an email, which Stone had in his possession at the time of 
his HPSCI testimony, that had the subject line “Back channel bs.” In the email, Credico wrote, 
“Well I have put together timelines[] and you [] said you have a back-channel way back a month 
before I had Assange on my show ... I have never had a conversation with Julian Assange other 
than my radio show . . . I have pieced it all together . . . so you may as well tell the truth that you 


had no back-channel or there’s the guy you were talking about early August.” (A copy of this 


email was obtained through a search of Stone’s email accoun' {ii ). 


Stone’s Testimony About Communications with the Trump Campaign 


49. During his HPSCI testimony, Stone was asked, “[d]id you discuss your 
conversations with the intermediary with anyone involved in the Trump campaign?” Stone 
answered, “I did not.” As described above, Stone spoke to multiple individuals involved in the 
Trump campaign about what he claimed to have learned from his intermediary to Assange, 
including the following: 

a. As described above, Gates confirmed to investigators that Stone spoke with senior 
Trump Campaign officials to inform them about materials possessed by Assange 
and the timing of future releases. 

b. According to text messages oe on or about 
October 3, 2016, Stone wrote to {J “Spoke to my friend in London last night. 
The payload is still coming.” 

c. As described above, on or about October 4, 2016, after receiving information 
from Credico about the delay in WikiLeaks’s release of stolen materials, Stone 
emailed Bannon that Assange had a “[s]erious security concern” but would 


release “a load every week going forward.” 
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G. Stone’s Attempts to Influence Credico Regarding HPSCI and the FBI 

50. According to an email recovered through a court-authorized search of Stone’s 
email account (MB. on or about October 19, 2017, Stone sent Credico an 
excerpt of his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his 
“intermediary” to Assange. As described below, Credico repeatedly told Stone that his letter was 
false and said he should correct his statement to HPSCI, but Stone did not do so. Stone then 
engaged in a prolonged effort to prevent Credico from contradicting Stone’s false statements to 
HPSCI. 

51. In or around November 2017, Credico received a request from HPSCI to testify 


voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted 


repeatedly with Stone 


a. On or about November 19, 2017, Credico texted Stone that his lawyer wanted to 
see him. Stone responded, ““Stonewall it. Plead the fifth. Anything to save the 
plan’ ... Richard Nixon.” (A copy of these text messages was recovered through 
a court-authorized search of Stone’s iCloud account). On or about November 20, 
2017, Credico informed HPSCI that he declined HPSCI’s request for a voluntary 
interview, 

b. On or about November 21, 2017, Credico texted Stone, “I was told that the house 
committee lawyer told my lawyer that I will be getting a subpoena.” Stone 


responded, “That was the point at which your lawyers should have told them you 
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would assert your 5th Amendment rights if compelled to appear.” (A copy of 
these text messages was recovered through a court-authorized search of Stone’s 
iCloud account). 

c. On or about November 28, 2017, Credico received a subpoena compelling his 
testimony before HPSCI. Credico informed Stone of the subpoena. 

d. According to emails recovered from  Stone’s email account 
N. on or about November 30, 2017, Stone asked Corsi to 
write publicly about Credico. Corsi responded, “Are you sure you want to make 
something out of this now? Why not wait to see what [Credico] does? You may 
be defending yourself too much — raising new questions that will fuel new 
inquiries. This may be a time to say less, not more.” Stone responded by telling 
Corsi that Credico “will take the Sth—but let’s hold a day.” 

e. According to text messages recovered from Stone’s iCloud account, on multiple 
occasions, starting on or about November 17, 2017, Stone and Credico discussed 
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part 
II, who falsely claims not to know critical information before a congressional 
committee that he does in fact know. On or about December 1, 2017, Stone told 
Credico in a text message to “Start practicing your Pentagele.”” When interviewed 
by the FBI, Credico confirmed that he understood Stone’s references to Frank 
Pentangeli to be Stone’s way of suggesting Credico withhold relevant information 
from investigators. 

f. On or about December 1, 2017, Stone texted Credico, “And if you turned over 


anything to the FBI you’re a fool.” Later that day, Credico texted Stone, “You 
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need to amend your testimony before I testify on the 15th.” Stone responded, “If 
you testify you’re a fool. Because of tromp I could never get away with a certain 
[sic] my Fifth Amendment rights but you can. I guarantee you you are the one 
who gets indicted for perjury if you’re stupid enough to testify.” (A copy of these 
text messages was recovered through a court-authorized search of Stone’s iCloud 
account). 

52. On or about December 12, 2017, Credico informed HPSCI that he intended to 
assert his Fifth Amendment privilege against self-incrimination if required to appear by 
subpoena. According to Credico, he invoked his Fifth Amendment privilege in part to avoid 
providing evidence that would show Stone’s previous testimony to Congress was false. 

53. Following Credico’s invocation of his Fifth Amendment privilege not to testify 
before HPSCI, Stone and Credico continued to have discussions about the various investigations 
into Russian interference in the 2016 election and what information Credico would provide to 
investigators. During these conversations, Stone repeatedly made aggressive statements intended 
to prevent Credico from cooperating with the investigations. For example: 

a. On or about December 24, 2017, Credico texted Stone, “I met assange for f]i]rst 
time this yea[r] sept 7 . . . docs prove that... You should be honest w fbi... 
there was no back channel... be honest.” Stone replied approximately two 
minutes later, “I’m not talking to the FBI and if your smart you won’t either.” (A 
copy of these text messages was recovered through a court-authorized search of 
Stone’s iCloud account). 

b. On or about April 9, 2018, Stone wrote in an email to Credico, “You are a rat. A 


stoolie. You backstab your friends—run your mouth my lawyers are dying Rip 
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you to shreds.” Stone also said he would “take that dog away from you,” 
referring to Credico’s dog. On or about the same day, Stone wrote to Credico, “I 
am so ready. Let’s get it on. Prepare to die [expletive].” (A copy of this email 
exchange was recovered through a court-authorized search of Stone’s email 
account i ). 

c. On or about May 21, 2018, Credico wrote in an email to Stone, “You should have 
just been honest with the house Intel committee ... you’ve opened yourself up to 
perjury charges like an idiot.” Stone responded, “You are so full of [expletive]. 
You got nothing. Keep running your mouth and Pl! file a bar complaint against 


$ 


your friend [the attorney who had the ability to contact Assange].” (A copy of 


this email exchange was recovered through a court-authorized search of Stone’s 
email account (MG). Credico believed Stone knew that Credico 

was sensitive to having this friend’s name publicly disclosed. 
H. Missing Electronic Communications and Stone’s Use of Encrypted Communications 
54. As described above, the government has recovered the content of many of Stone’s 
electronic communications from summer and fall of 2016 (during the period of the U.S. 
presidential election) and afterward (during the period of pending congressional investigations 
into Russian interference in the U.S. election). However, the government is aware of the 
existence of numerous other relevant electronic communications, the content of which it has not 

yet been able to recover. 

55. As described above, during his HPSCI testimony, Stone falsely denied having 
emailed or exchanged text messages with his “intermediary” (later identified by Stone as Randy 


Credico). In fact, emails and text messages recovered in this investigation show the two 
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communicated frequently by email and text messages; court-authorized searches of Stone’s 
emai] and iCloud accounts confirm that Stone still had those communications at the time he 
testified in or around September 2017. In numerous communications, Stone and Credico 
discussed Julian Assange and WikiLeaks, as well as Stone’s suggestion that Credico was his 
intermediary to Assange. These communications appear relevant and responsive to HPSCI’s 
inquiry, but Stone never disclosed them. 

56. In addition to these emails and text messages in the FBI’s possession, the FBI has 
reviewed telephone billing records for Stone’s cellular telephone for the years 2016 and 2017, 
and they show text message communications whose content that the government to date has not 
been able to obtain. For example, these records indicate that Stone and Credico alone exchanged 
thousands of text messages (including over 1,500 text messages between the period November 
2016 and December 2017) the substance of which the government to date has not recovered or 
reviewed. The government has only recently obtained text messages between Stone and Credico 
during some period of the campaign in 2016 from Stone’s subpoena production, issued after 
media reports in November 2018 stated that Stone’s attorneys were able to extract text messages 
between Stone and Credico from a phone Stone stopped using in 2016. But the government does 
not have, for the same time period, many of Stone’s other text messages. The government seeks 
these text messages believing they may show additional evidence of (1) the falsity of Stone’s 
HPSCI testimony concerning his communications with his “intermediary” and (2) efforts to 
corruptly persuade Credico not to cooperate with pending investigations. 

57. Additionally, the FBI has interviewed multiple associates of Stone, who 
confirmed that Stone has used encrypted applications to communicate with others. Similarly, 


records obtained in this investigation indicate Stone uses multiple applications designed for 
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encrypted communication, including (a) WhatsApp,'' (b) Signal,’ (c) Wickr,? and (d) 


i 


ProtonMai To date, the FBI has not obtained any of Stone’s communications conducted 


through these applications. 
a. According to records from Stone’s iCloud account, a copy of the WhatsApp 
application was downloaded to an iPhone registered to Stone on or about October 
5, 2016. As described above, on or about October 4, 2016, Stone suggested in an 
email to (J that they “talk on a secure line” and proposed using 

WhatsApp. 
b. According to records from Stone’s iCloud account, a copy of the Signal 
application was downloaded to an iPhone registered to Stone on or about August 


18, 2016. Additionally, text messages recovered from Stone’s iCloud account 


n According to open sources, WhatsApp is an application that allows the user to send text 
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and 
stores its messages separately from those text messages used on a mobile device’s default 
message application. 


'2 According to open sources, Signal is an encrypted communications application allowing the 
user to send one-to-one and group messages, which can include files, voice notes, images and 
videos, and make one-to-one voice and video calls. Signal uses standard cellular mobile 
numbers as identifiers, and uses end-to-end encryption to secure all communications to other 
Signal users. Signal also allows users to set timers to messages, after which the messages will be 
deleted from both the sender’s and the receivers’ devices. 


3 According to open sources, Wickr is an instant messaging application that allows users to 
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file 
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows 
users to set an expiration time for their encrypted communications. In addition to encrypting 
user data and conversations, Wickr claims that its application strips metadata from all content 
transmitted through the network. 


'* According to open sources, ProtonMail is an end-to-end encrypted email service that uses 
client-side encryption to protect email contents and user data before they are sent to ProtonMail 
servers. According to its website, ProtonMail is run by Proton Technologies AG, a company 
based in the Canton of Geneva, and its servers are located at two locations in Switzerland, 
outside of US and EU jurisdiction. 
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revealed that on or about November 15, 2016, Stone sent an attorney with the 
ability to contact Julian Assange a link to download the Signal application." 
Approximately fifteen minutes after sending the link, Stone texted the attorney, 
“Tm on signal just dial my number.” The attorney responded, “PH call you.” 

c. According to records from Stone’s iCloud account, a copy of the ProtonMail 
application was downloaded to an iPad registered to Stone on or about August 18, 
2016. 

d. According to records from Stone’s iCloud account, a copy of the Wickr 
application was downloaded to an iPhone registered to Stone on or about August 
5, 2017. 

58. Based on my training and experience, electronic communications using encrypted 
applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the 
device used to send and receive those communications. Communications from those 
applications can be obtained by law enforcement by searching the device either manually or via a 
data extraction device (such as Cellebrite). Searches of the physical device can reveal messages, 
including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and 
Wickr, that have not been backed up to cloud accounts (such as an iCloud account). 
Additionally, review of the device and the downloaded application can reveal other evidence of 
encrypted communications, such as call logs and contact lists. 

59. The FBI continues to seek evidence of Stone’s communications and contacts 


during the period of the 2016 U.S. presidential election and through the present. The FBI 


'S This attorney was a close friend of Credico’s and was the same friend Credico emailed on or 
about September 20, 2016 to pass along Stone’s request to Assange for emails connected to the 
allegations against then-candidate Clinton related to her service as Secretary of State.. 
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believes these communications may contain evidence of additional communications concerning 
Assange, WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign. 
Such communications could constitute additional evidence of Stone’s efforts to obstruct 
HPSCI’s investigation by showing additional contacts and communications about Assange and 
WikiLeaks that Stone failed to disclose. 

I. Other Relevant Records 

60. On or about May 8, 2018, a law enforcement interview of D 
GE «was conducted. §was an employee of Stone’s from approximately June 2016 
through approximately December 2016 and resided in Stone’s previous New York apartment for 
a period of time. PB provided information technology support for Stone but was not formally 
trained to do so. [was aware that Stone communicated with Trump during the 2016 
presidential campaign, and afterward, both in person and by telephone. [provided 
information about a meeting at Trump Tower between Trump and Stone during the time BEE 
worked for him, to which Stone carried a “file booklet” with him. Stone told [the file 
booklet was important and that no one should touch it. [J also said Stone maintained the file 
booklet in his closet. 

61. On or about December 3, 2018, law enforcement conducted an interview of an 
individual (“Person 2”) who previously had a professional relationship with a reporter who 
provided Person 2 with information about Stone. The reporter relayed to Person 2 that in or 
around January and February 2016, Stone and Trump were in constant communication and that 
Stone kept contemporaneous notes of the conversations. Stone’s purpose in keeping notes was to 


later provide a “post mortem of what went wrong.” 
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J. The Subject Premises 

62. Your affiant is aware through the investigation that Stone maintains the Subject 
Premises as his primary residence.'® During physical surveillance of the Subject Premises on or 
about January 14, 2019, the FBI observed Stone at the residence. 

63. Records produced by Comcast on August 23, 2018 
GE show that the subscriber of high-speed internet service and digital voice services at the 
Subject Premises was Nydia Stone. According to public reporting and law enforcement 
interviews, Nydia Stone is the spouse of Stone. 

64. According to emails obtained through a court-authorized search of Stone’s email 
acount, Stone sent an email on or about January 2, 2018 requesting the 
recipient “update your files with my new address”; Stone identified the Subject Premises as his 
new address. Additionally, in an email dated on or about August 2, 2018, Stone provided the 
Subject Premises as his shipping address. 

K. Computer Devices at the Subject Residence 

65. Based on law enforcement interviews, your affiant is aware that Stone has used 
and uses cellular telephones, desktop, and laptop computers to conduct electronic 
communications. Stone also configures his computers to create regulars backups of his 
computers and maintains one of these devices at the Subject Premises, which preserves 


documents and communications. 


é Stone also maintains a residen ee fat New York, New 


York. 
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66. In or around May 2018, the FBI interviewed an individual (“Person 2”) who 
provided information technology services to Stone. According to Person 2, Stone maintains at 
least one Apple computer in each of his residences and also had an Apple MacBook Pro laptop 
computer at one point in time. I? crson 2 revealed billing 
receipts and invoices issued to Nydia Bertran-Stone for information technology (“IT”) services 
dated January 2015 through May 2018. The records also show that Nydia Bertran-Stone was 
billed for IT services in connection with three different Apple computers. Specifically, the 
billing receipts show services for (1) an Apple iMac (serial number D25SY03RGQI7) 
configured with the name “Stone-Roger-iMac-FL”; (2) a second Apple iMac (serial number 
D25TC077GQ17) configured with the name “Stone-Roger-iMac-NYC”; and (3) an Apple 
MacBookPro 10 (serial number CO2KLOSEFFT4) configured with the name “Stone-Nydia- 
MBPR.” According to publicly available information, the iMac is one of Apple’s desktop 
models (i.e., a computer designed to be stationary). The naming convention of the computer 
‘“Stone-Roger-iMac-FL” therefore suggests it is a stationary computer used by Stone and located 
at the Subject Premises.” According to the billing records, the computer was serviced on or 
about May 26, 2018. 

67. Person 2 also told law enforcement that Stone used the Apple Time Machine 
(“Time Machine”) application to facilitate backups of his computers and that he believed Stone 
used Time Machine on computers in his residences. According to publicly available 
information, Time Machine is the built-in backup feature of Apple computers and can create 
copies of files on a computer, including applications, music, photos, email, documents, and 
system files. A Time Machine backup allows users to restore files from a specific point in time 


'7 According to multiple associates of Stone interviewed by the FBI, Stone maintains an office in 
the Subject Residence and conducts most of his work from the office when he is in Florida. 
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if the original files are ever deleted, or if the hard drive is erased or replaced. In order to create 
backups with Time Machine, a user connects an external storage device to the computer and 
selects that external storage device as the backup disk.'® 

68. Records produced by AT&T I show that, 
since 2016, Stone has had multiple Apple iPhone devices registered to his personal cellular 
telephone number (ending in MM). According to AT&T, between approximately January 1, 
2015 and November 14, 2016, Stone’s telephone number was registered to an Apple iPhone 
model 5s (“iPhone 5s”) (IMSI 310410657061814). On or about November 14, 2016, Stone’s 
cellular telephone number was transferred to an Apple iPhone model 7 (“iPhone 7”) (IMSI 
310410930460769). On or about September 28, 2018, Stone’s cellular telephone number was 
transferred to an Apple iPhone model XS (“iPhone XS”) (IMSI 310410155529814). 

69. Records produced by Uber Technologies, Inc, (i 
show that the account associated with Stone’s telephone number and email address has the Uber 
application on multiple devices, including a device identified as iPhonel 1,2, UDID - 668EDC66- 
29BF-4AD2-8BCA-D974C7906597. Publicly available information indicates that the identifier 
“iPhonel1,2” correlates to an Apple iPhone model XS. Additionally, the subpoena returns 
identified a device identified as iPhone9,4, UDID - 7161CF59-6F10-41C8-984B- 
DE08401EDA74. Publicly available information indicates that the identifier iPhone9,4 
correlates to an Apple iPhone model iPhone 7 Plus. 

70. Records obtained from a court-authorized pen register/trap & trace (“PRTT”) 
monitoring of Stone’s personal cellular telephone number Bh” shows recent activity 
'§ When the external is plugged in, the Time Machine will automatically make hourly backups 
for the past 24 hours, daily backups for the past month, and weekly backups for all previous 


months. The oldest backups are deleted when the external storage device selected as the backup 
disk is full. The external device can be as small as a USB thumb drive. 
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+ 


indicating Stone continues to use the number and its associated device. For example, these 
records show that between January 1, 2019 and January 10, 2019, telephone number [J was 
used to make or receive over 150 telephone calls and send or receive over 750 text messages. 
Likewise, a court-authorized PRTT of Stone’s WhatsApp account (which is registered to Stone’s 
telephone number °° showed the WhatsApp account was used to send or receive 
approximately 13 WhatsApp messages and two WhatsApp voice calls between on or about 
January 1, 2019 and January 10, 2019. 

diy Statements attributed to Stone in recent media articles also indicate that Stone 
retains computer devices that he no longer uses and keeps relevant electronic communications on 
those devices. In or around November 2018, media reports began to publish excerpts of text 
messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies 
of these text messages subsequently were obtained from Stone S. 
According to these news articles, Stone released these messages to the media outlets, which 
Stone claimed were extracted by his lawyers from “a cell phone he stopped using in 2016.” 
Based on these statements, your affiant believes the cellular telephone referenced in the article to 


be the iPhone 5s documented in the aforementioned AT&T records (which records indicate he 


'? Installation and use of PRTT devices for {J was authorized by the U.S. District Court for 
the District of Columbia on or about November 28, 2018. Case No. 1:18-pr-172 (D.D.C. Nov. 
28, 2018). 


20 Installation and use of PRTT devices for Stone’s WhatsApp account was authorized by the 
U.S. District Court for the District of Columbia on or about December 11, 2018. Case No. 1:18- 
pr-250 (D.D.C. Dec. 11, 2018). 


21 See, e.g, “Bombshell Text Messages Support Roger Stone’s Claims About WikiLeaks 


Backchannel,” Daily Caller, Nov. 14, 2018, available at 
https://dailycaller.com/201 8/1 1/14/roger-stone-wikileaks-randy-credico-mueller. 
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stopped using on or about November 14, 2016).” Further, your affiant believes Stone maintains 
other devices he is no longer actively using. 


COMPUTERS, ELECTRONIC STORAGE, AND FORENSIC ANALYSIS 


72. As described above and in Attachment B, this application seeks permission to 
search for records that might be found in the Subject Premises, in whatever form they are found. 
One form in which the records might be found is data stored on a computer device’s hard drive 
or other storage media. Thus, the warrant applied for would authorize the seizure of electronic 
storage media or, potentially, the copying of electronically stored information, all under Rule 
41(e)(2)(B). 

73. Probable cause. | submit that if a computer or storage medium is found on the 
Subject Premises, there is probable cause to believe those records will be stored on that computer 
or storage medium, for at least the following reasons: 

a. Based on my knowledge, training, and experience, I know that computer files or 
remnants of such files can be recovered months or even years after they have been 
downloaded onto a storage medium, deleted, or viewed via the Internet. 
Electronic files downloaded to a storage medium can be stored for years at little 
or no cost. Even when files have been deleted, they can be recovered months or 
years later using forensic tools. This is so because when a person “deletes” a file 
on a computer, the data contained in the file does not actually disappear; rather, 
that data remains on the storage medium until it is overwritten by new data. 


“GEE Stone produced some text messages between he and 


Credico; the latest-in-time text message produced by Stone occurred on or about November 14, 
2016. The government believes copies of later-in-time text messages from late 2016 and early 
2017 could be located on another device, such as the iPhone 7 described above, or on backup 
storage media. 
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74. 


Therefore, deleted files, or remnants of deleted files, may reside in free space or 
slack space—that is, in space on the storage medium that is not currently being 
used by an active file—for long periods of time before they are overwritten. In 
addition, a computer’s operating system may also keep a record of deleted data in 
a “swap” or “recovery” file. 

Wholly apart from user-generated files, computer storage media—in particular, 
computers’ internal hard drives—contain electronic evidence of how a computer 
has been used, what it has been used for, and who has used it. To give a few 
examples, this forensic evidence can take the form of operating system 
configurations, artifacts from operating system or application operation, file 
system data structures, and virtual memory “swap” or paging files. Computer 
users typically do not erase or delete this evidence, because special software is 
typically required for that task. However, it is technically possible to delete this 
information. 

Similarly, files that have been viewed via the Internet are sometimes 
automatically downloaded into a temporary Internet directory or “cache.” 


Forensic evidence. As further described in Attachment B, this application seeks 


permission to locate not only computer files that might serve as direct evidence of the crimes 


described on the warrant, but also for forensic electronic evidence that establishes how 


computers were used, the purpose of their use, who used them, and when. There is probable 


cause to believe that this forensic electronic evidence will be on any storage medium in the 


Subject Premises because: 
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a. Data on the storage medium can provide evidence of a file that was once on the 
storage medium but has since been deleted or edited, or of a deleted portion of a 
file (such as a paragraph that has been deleted from a word processing file). 
Virtual memory paging systems can leave traces of information on the storage 
medium that show what tasks and processes were recently active. Web browsers, 
e-mail programs, and chat programs store configuration information on the 
storage medium that can reveal information such as online nicknames and 
passwords. Operating systems can record additional information, such as the 
attachment of peripherals, the attachment of USB flash storage devices or other 
external storage media, and the times the computer was in use. Computer file 
systems can record information about the dates files were created and the 
sequence in which they were created, although this information can later be 
falsified. 

b. As explained herein, information stored within a computer and other electronic 
storage media may provide crucial evidence of the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the 
United States to establish and prove each element or alternatively, to exclude the 
innocent from further suspicion. In my training and experience, information 
stored within a computer or storage media (e.g., registry information, 
communications, images and movies, transactional information, records of 
session times and durations, internet history, and anti-virus, spyware, and 
malware detection programs) can indicate who has used or controlled the 


computer or storage media. This “user attribution” evidence is analogous to the 
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search for “indicia of occupancy” while executing a search warrant at a residence. 
The existence or absence of anti-virus, spyware, and malware detection programs 
may indicate whether the computer was remotely accessed, thus inculpating or 
exculpating the computer owner. Further, computer and storage media activity 
can indicate how and when the computer or storage media was accessed or used. 
For example, as described herein, computers typically contains information that 
log: computer user account session times and durations, computer activity 
associated with user accounts, electronic storage media that connected with the 
computer, and the IP addresses through which the computer accessed networks 
and the internet. Such information allows investigators to understand the 
chronological context of computer or electronic storage media access, use, and 
events relating to the crime under investigation. Additionally, some information 
stored within a computer or electronic storage media may provide crucial 
evidence relating to the physical location of other evidence and the suspect. For 
example, images stored on a computer may both show a particular location and 
have geolocation information incorporated into its file data. Such file data 
typically also contains information indicating when the file or image was created. 
The existence of such image files, along with external device connection logs, 
may also indicate the presence of additional electronic storage media (e.g., a 
digital camera or cellular phone with an incorporated camera). The geographic 
and timeline information described herein may either inculpate or exculpate the 
computer user. Last, information stored within a computer may provide relevant 


insight into the computer user’s state of mind as it relates to the offense under 
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investigation. For example, information within the computer may indicate the 
owner’s motive and intent to commit a crime (e.g., internet searches indicating 
criminal planning), or consciousness of guilt (e.g., running a “wiping” program to 
destroy evidence on the computer or password protecting/encrypting such 
evidence in an effort to conceal it from law enforcement). 

c. A person with appropriate familiarity with how a computer works can, after 
examining this forensic evidence in its proper context, draw conclusions about 
how computers were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact files, blocks, registry entries, logs, or other 
forms of forensic evidence on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. While it is possible to specify in 
advance the records to be sought, computer evidence is not always data that can 
be merely reviewed by a review team and passed along to investigators. Whether 
data stored on a computer is evidence may depend on other information stored on 
the computer and the application of knowledge about how a computer behaves. 
Therefore, contextual information necessary to understand other evidence also 
falls within the scope of the warrant. 

e. Further, in finding evidence of how a computer was used, the purpose of its use, 
who used it, and when, sometimes it is necessary to establish that a particular 
thing is not present on a storage medium. For example, the presence or absence 
of counter-forensic programs or anti-virus programs (and associated data) may be 


relevant to establishing the user’s intent. 
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75. Necessity of seizing or copying entire computers or storage media. In most cases, 
a thorough search of a premises for information that might be stored on storage media often 
requires the seizure of the physical storage media and later off-site review consistent with the 
warrant. In lieu of removing storage media from the premises, it is sometimes possible to make 
an image copy of storage media. Generally speaking, imaging is the taking of a complete 
electronic picture of the computer’s data, including all hidden sectors and deleted files. Either 
seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded 
on the storage media, and to prevent the loss of the data either from accidental or intentional 
destruction. This is true because of the following: 

a. The time required for an examination. As noted above, not all evidence takes the 
form of documents and files that can be easily viewed on site. Analyzing 
evidence of how a computer has been used, what it has been used for, and who 
has used it requires considerable time, and taking that much time on premises 
could be unreasonable. As explained above, because the warrant calls for forensic 
electronic evidence, it is exceedingly likely that it will be necessary to thoroughly 
examine storage media to obtain evidence. Storage media can store a large 
volume of information. Reviewing that information for things described in the 
warrant can take weeks or months, depending on the volume of data stored, and 
would be impractical and invasive to attempt on-site. 

b. Technical requirements. Computers can be configured in several different ways, 
featuring a variety of different operating systems, application software, and 
configurations. Therefore, searching them sometimes requires tools or knowledge 


that might not be present on the search site. The vast array of computer hardware 
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and software available makes it difficult to know before a search what tools or 
knowledge will be required to analyze the system and its data on the Premises. 
However, taking the storage media off-site and reviewing it in a controlled 
environment will allow its examination with the proper tools and knowledge. 

c. Variety of forms of electronic media. Records sought under this warrant could be 
stored in a variety of storage media formats that may require off-site reviewing 
with specialized forensic tools. 

76. Nature of examination. Based on the foregoing, and consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying 
storage media that reasonably appear to contain some or all of the evidence described in the 
warrant, and would authorize a later review of the media or information consistent with the 
warrant. The later review may require techniques, including but not limited to computer-assisted 
scans of the entire medium, that might expose many parts of a hard drive to human inspection in 
order to determine whether it is evidence described by the warrant. 

77. Because multiple people share the Subject Premises as a residence, it is possible 
that the Subject Premises will contain storage media that are predominantly used, and perhaps 
owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is 
possible that the things described in this warrant could be found on any of those computers or 
storage media, the warrant applied for would permit the seizure and review of those items as 


well. 


FILTER REVIEW PROCEDURES 
Review of the items described in Attachment B will be conducted pursuant to established 


procedures designed to collect evidence in a manner consistent with professional responsibility 
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requirements concerning the maintenance of attorney-client and other operative privileges. The 
procedures include use of a designated “filter team,” separate and apart from the investigative 
team, in order to address potential privileges. 
SEALING ORDER REQUESTED 

78. Itis further respectfully requested that this Court issue an Order sealing, until 
further order of this Court, all papers submitted in support of this application, including the 
application, affidavit, and search warrant, and the requisite inventory notice. Sealing is necessary 
because items and information to be seized are relevant to an ongoing investigation, and 
premature disclosure of the contents of this affidavit and related documents may have a negative 
impact on this continuing investigation and may jeopardize its effectiveness. 

CONCLUSION 

79. Based on the foregoing, your affiant respectfully requests that this Court issue a 

search warrant for the Subject Premises, more particularly described in Attachment A, 


authorizing the seizure of the items described in Attachment B. 


Respectfully submitted, 
Curtis A. Heide 
pecial Agent 


Federal Bureau of Investigation 


Sworn to and subscribed before me on this Fy day of January, 2019. 


ex S. SNOW 


UNITED STATES MAGISTRATE JUDGE 
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AO 93 (Rev. 12/09) Search and Seizure Warrant 


UNITED STATES DISTRICT COURT 


for the 
Southern District of Florida 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


Oakland Park, Florida W 
(further described in Attachment "A") 


Case No. 19-6034-SNOW 


SA NA i N 


SEARCH AND SEIZURE WARRANT 
To: Any authorized law enforcement officer 


An application by a federal law enforcement officer or an attorney for the government requests the search 
of the following person or property located in the Southern District of Florida 
(identify the person or describe the property to be searched and give its location): 


ES «Oakland Park, Florida {J (further described in Attachment "A") 


The person or property to be searched, described above, is believed to conceal (identify the person or describe the 
property to be seized): 


See Attachment "B" 


I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or 
property. 


YOU ARE COMMANDED to execute this warrant on or before For F pa D IF 
(not to exceed 14 days) 
gÍ in the daytime 6:00 a.m. to 10 p.m. O at any time in the day or night as I find reasonable cause has been 
established. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the 
place where the property was taken. 


The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an 
inventory as required by law and promptly return this warrant and inventory to United States Magistrate Judge 
Lurana S. Snow 


(name) 


O I find that immediate notification may have an adverse result listed in 18 U.S.C. § 2705 (except for delay 
of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be 
searched or seized (check the appropriate box) © for days (not to exceed 30). 


O until, the facts justifying, the later specific date of 


Date and time issued: Vou / 19 l: = joana A Pi p pee 


Judge's signature 


City and state: Fort Lauderdale, Florida Lurana S. Snow, United States Magistrate Judge 


Printed name and title 
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ATTACHMENT A 


IS 0 201 Park, Florida 33334. 


The Subject Premises is a commercial space with a glass front door and glass windows covered 


with a black fabric; a green awning bearing the letters “JVR” is above the door. A photograph of 


the exterior of the Subject Premises is attached below. 
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l. 


ATTACHMENT B 


Property to be seized from the Subject Premises 


The items to be seized are fruits, evidence, information relating to, contraband, or 


instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of 


proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 


United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for 


the time period June 2015 to the present, including: 


a. 


Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 
Documents reflecting communications between Stone and Jerome Corsi; 
Documents reflecting communications between Stone and Randy Credico; 
Documents reflecting communications between Stone and members of the Trump 
Campaign or Trump Campaign associates, including Steve Bannon, Sy, 
Paul Manafort, Richard Gates, and Donald J. Trump; 

Documents related to or discussing the U.S. House of Representatives Permanent 
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or 


the Federal Bureau of Investigation; 


Records and information relating to the e-mail accounts 
and as : 


Records and information relating to the WhatsApp account associated with 


telephone number M. 


Records and information relating to the Signal account associated with telephone 


number as 
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2, 


Records and information relating to the Wickr account associated with telephone 
number a. 

Any computers, media storage devices, tablets/iPads, cellular telephones, 
smartphones, personal data assistant devices, or other electronic devices used to 
commit the violations described above or to store records or documents described 
above; 

Records of personal and business activities relating to the operation and 
ownership of the computer systems, such as telephone records, notes, notebooks, 
diaries, and reference materials, in whatever form; 

Records pertaining to accounts held with Internet Service Providers or of Internet 
use, in whatever form; 


For any computer or storage medium whose seizure is otherwise authorized by 


this warrant, and any computer or storage medium that contains or in which is stored records or 


information that is otherwise called for by this warrant (hereinafter, “COMPUTER”): 


a. 


evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, documents, 
browsing history, user profiles, email, email contacts, “chat,” instant messaging 
logs, photographs, and correspondence; 

evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 


software; 
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c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events relating 
to crime under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime 
under investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 

g. evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’s Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 
records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 


attachment. 
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= 
: 
e 


AO 93 (Rev. 12/09) Search and Seizure Warrant (Page 2) 


Case No.: Date and time warrant executed: Copy of warrant and inventory left with: 
19-6034-SNOW 
Inventory made in the presence of: 


Inventory of the property taken and name of any person(s) seized. 


Certification 


I declare under penalty of perjury that this inventory is correct and was returned along with the original 
warrant to the designated judge. 


Date: 


Executing officer's signature 


Printed name and title 
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AO 106 (Rev. 04/10) Application for a Search Warrant 


UNITED STATES DISTRICT COURT 


for the 
Southern District of Florida 


In the Matter of the Search of 


(Briefly describe the property to be searched 
or identify the person by name and address) 


SS O2k\and Park, Florida further described 


in Attachment "A") 


Case No. 19-6034-SNOW 


ee aa 


APPLICATION FOR A SEARCH WARRANT 


I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 


GS «Oakland Park, Florida MM (further described in Attachment "A") 


located in the Southern District of Florida , there is now concealed (identify the 
person or describe the property to be seized): 


See Attachment "B" 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
Mf evidence of a crime; 


contraband, fruits of crime, or other items illegally possessed; 
aí property designed for use, intended for use, or used in committing a crime; 
© a person to be arrested or a person who is unlawfully restrained. 


The search is related to a violation of: 


Code Section Offense Description 
18 U.S.C. 1505 Obstruction of Proceeding 
18 U.S.C. 1001 False Statements 
18 U.S.C. 1512(b)(1) Witness Tampering 


The application is based on these facts: 


See attached Affidavit. 


a Continued on the attached sheet. 


O Delayed notice of days (give exact ending date if more than 30 days: ) is requested 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


ett Ej. A en E 


Applicant's signature 


Curtis A. Heide, Special Agent, FBI 


Printed name and title 


Sworn to before me and signed in my presence. 


owe: Poul (Dessrcnce 3, donee) 


wdge's signature 


City and state: Fort Lauderdale, Florida Lurana S. Snow, United States Magistrate Judge 


Printed name and title 
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ATTACHMENT A 


NS 02k 206 Pack, Florida 
A 
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l. 


ATTACHMENT B 


Property to be seized from the Subject Premises 


The items to be seized are fruits, evidence, information relating to, contraband, or 


instrumentalities of violations Title 18, United States Code, Section 1505 (obstruction of 


proceeding); (ii) Title 18, United States Code, Section 1001 (false statements); and (iii) Title 18, 


United States Code 1512(b)(1) (witness tampering), those violations involving Roger Stone, for 


the time period June 2015 to the present, including: 


a. 


Documents and communications that discuss or are related to WikiLeaks, Julian 
Assange, and/or Russian interference in the 2016 U.S. presidential election; 
Documents reflecting communications between Stone and Jerome Corsi; 
Documents reflecting communications between Stone and Randy Credico; 
Documents reflecting communications between Stone and members of the Trump 
Campaign or Trump Campaign associates, including Steve Bannon, J 
Paul Manafort, Richard Gates, and Donald J. Trump; 

Documents related to or discussing the U.S. House of Representatives Permanent 
Select Committee on Intelligence, the Senate Select Committee on Intelligence, or 


the Federal Bureau of Investigation; 


Records and information relating to the e-mail accounts 
and 


Records and information relating to the WhatsApp account associated with 


telephone number I: 


Records and information relating to the Signal account associated with telephone 


number as : 
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i. Records and information relating to the Wickr account associated with telephone 
me 

j. Any computers, media storage devices, tablets/iPads, cellular telephones, 
smartphones, personal data assistant devices, or other electronic devices used to 
commit the violations described above or to store records or documents described 
above; 

k. Records of personal and business activities relating to the operation and 
ownership of the computer systems, such as telephone records, notes, notebooks, 
diaries, and reference materials, in whatever form; 

l. Records pertaining to accounts held with Internet Service Providers or of Internet 
use, in whatever form; 

2; For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, “COMPUTER”: 

a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, documents, 
browsing history, user profiles, email, email contacts, “chat,” instant messaging 
logs, photographs, and correspondence; 

b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 


software; 
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c. evidence of the lack of such malicious software; 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use, and events relating 
to crime under investigation and to the computer user; 

e. evidence indicating the computer user’s state of mind as it relates to the crime 
under investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 

g. evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used; 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’s Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 
records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 


attachment. 
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AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Curtis A. Heide, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

i I make this affidavit in support of an application for a search warrant for the 
premises known and described as I Oakland Park, Florida J described 
in the following paragraphs and further in Attachment A. 

2. I am a Special Agent (SA) of the Federal Bureau of Investigation (FBI) and have 
been since 2006. In the course of my duties, I have been responsible for investigating federal 
crimes and national security matters involving both counterintelligence and issues related to 
cybersecurity. 

3 I am currently involved in the investigation into Roger Jason Stone, Jr., (“Roger 
Stone”) and others known and unknown to the government, for the commission of unlawful 
activities in the Southern District of Florida, and elsewhere, including, but not limited to: (i) 
obstruction of proceeding, in violation of Title 18, United States Code, Section 1505; (ii) false 
statements, in violation of Title 18, United States Code, Section 1001 and (iii) witness tampering, 
in violation of Title 18, United States Code 1512(b)(1) (collectively the “Specified Federal 
Offenses”), 

4, I have personally participated in this investigation and am aware of the facts 
contained herein based on my own investigation, as well as my review of documents, records, 
and information provided to me by other law enforcement officers and technical experts. 

5. This affidavit is intended to show merely that there is sufficient probable cause 
for the requested warrant and does not set forth all of my knowledge about this matter. Unless 


specifically indicated, all conversations and statements in this affidavit are related in substance 
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and part. Where I assert that an event took place on a particular date, I am asserting that it took 
place on or about the date specified. 

6. I make this affidavit in support of an application for a warrant to search the 
premises located at J, Oakland Park, Florida {J (the “Subject Premises,” 
as is more particularly described in Attachment A), in connection with the Specified Federal 
Offenses, for the items enumerated in Attachment B, which constitute evidence, contraband, 
fruits, and instrumentalities of the Specified Federal Offenses. 

7. For the reasons set forth in this Affidavit, there is probable cause to believe that 
one or more of the Specified Federal Offenses have been committed by Roger Stone and others 
known and unknown to the government. Further, there is probable cause to believe the Subject 
Premises have been used to facilitate the commission of one or more of the Specified Federal 
Offenses. Moreover, there is probable cause to believe that evidence, contraband, fruits, and 
instrumentalities of violations of the Specified Federal Offense may be present in the Subject 


Premises. 


PROBABLE CAUSE 
A. Background on Relevant Individuals 
8. Roger Stone is a political consultant who has worked for decades in U.S. politics 
and on U.S. political campaigns. Stone was an official on the U.S. presidential campaign of 
Donald J. Trump (“Trump Campaign”) until in or around August 2015, and subsequently 
maintained regular contact with and publicly supported the Trump Campaign through the 2016 


election. 
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9, Julian Assange is the founder and director of WikiLeaks, which is publicly 
described as a non-profit organization that disseminates non-public information and classified 
media provided by anonymized sources. WikiLeaks has posted numerous documents stolen from 
the U.S. government. At all relevant times, Assange was located at the Ecuadorian Embassy in 
London, United Kingdom. 

10. Jerome Corsi is a political commentator who worked with an online media 
publication during the 2016 U.S. presidential campaign. As set forth below, Corsi spoke 
regularly with Stone throughout the campaign, including about the release of stolen documents 


by WikiLeaks, 


12. Based on the investigation to date, Randy Credico was a radio host who has 


known Stone for more than a decade. In testimony before the U.S. House of Representatives 
Permanent Selection Committee on Intelligence (“HPSCI”) on or about September 26, 2017, 
Stone described Credico (without naming him) as an “intermediary,” “go-between,” and “mutual 
friend” to Assange. In a follow-up letter to HPSCI dated October 13, 2017, Stone identified 
Credico by name and claimed Credico was the “gentleman who confirmed for Mr. Stone” that 


S66 


Assange, had “‘[e]mails related to Hillary Clinton which are pending publication.” 
13. Richard Gates is a U.S. citizen who served for years as a political consultant and 


lobbyist along with Paul Manafort. From in or around June 2016 until November 2016, Gates 


served as the deputy campaign chairman of the Trump Campaign. On February 23, 2018, Gates 
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pled guilty to one count of conspiracy against the United States and one count of making false 
statements to federal law enforcement officers. United States v. Gates, 1:17-cr-201 (D.D.C.). 
14. Steve Bannon is a U.S. citizen who serves as a political consultant. Beginning in 


or around August 2016 and through the 2016 U.S. presidential election, Bannon served as the 


chief executive officer of the Trump Campaign. 


B. Hacking Activity During the 2016 Presidential Election 

16. John Podesta is a U.S. citizen who served for years as a political consultant. 
During the 2016 U.S. presidential campaign, Podesta served as the campaign chairman of the 
Hillary Clinton presidential campaign (“Clinton Campaign”). On or about March 24, 2016, 
Podesta received a spearphishing' email designed to appear as a security notification (a partial 
copy of the email was recovered by the FBI from a subsequent release of stolen emails, 
described below). During an interview with the FBI in or around May 2018, Podesta indicated 
that after receiving the email, his assistant (who also had access to the account) clicked on a link 
within the email and entered the account password when prompted (believing this prompt to be 
part of a security protocol). Based on my training and experience, this activity appears to have 
been a successful spearphishing operation, through which an actor would have gained access to 


Podesta’s email account, allowing the actor to steal emails and documents from that account. 


' In my training and experience, spearphishing in this context refers to the fraudulent practice of 
sending an email that purports to be from a known or trusted sender in order to induce the 
targeted victim to respond in a desired manner, typically by clicking a malicious link or URL. 
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17. The Democratic National Committee (“DNC”) and Democratic Congressional 
Campaign Committee (“DCCC”) are U.S. political committees focusing on U.S. federal 
elections. Both the DNC and DCCC were involved in the 2016 U.S. federal elections, including 
the 2016 U.S. presidential election. According to DNC and DCCC individuals interviewed by 
the Special Counsel’s Office, in or around the spring of 2016, the DNC and DCCC became 
aware that their computer systems had been compromised by unauthorized intrusions and hired 
the cybersecurity company CrowdStrike to investigate the intrusions and remediate. 

18. On or about June 14, 2016, CrowdStrike issued a public press release announcing 
that the DNC’s computer network had been compromised. In the public statement, CrowdStrike 
indicated that it had identified “two sophisticated adversaries on the network,” which it referred 
to by the monikers COZY BEAR and FANCY BEAR. CrowdStrike stated that it had previously 
seen these actors target other customers and that, based on their experience, “[b]oth adversaries 
engage in extensive political and economic espionage for the benefit of the government of the 
Russian Federation and are believed to be closely linked to the Russian government’s powerful 
and highly capable intelligence services.” 

19. Onor about July 13, 2018, a federal grand jury sitting in the District of Columbia 
returned an indictment against eleven Russian nationals, charging them with partaking in a 
conspiracy to hack into, among other things, the email account of John Podesta, as well as the 
DNC and DCCC computer networks. United States v. Viktor Borisovich Netyksho, 1:18-cr-215 
(D.D.C.). The indictment alleges that all of these individuals were military officers serving in 
the Main Intelligence Directorate of the General Staff (“GRU”), the Russian Federation’s 


military intelligence agency. 
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C. WikiLeaks’ Release of Stolen Documents During the 2016 Presidential Campaign 

20. As alleged in the Netyksho indictment, after successfully hacking the DNC and 
DCCC networks, as well as Podesta’s email account, GRU officers transmitted some of the 
stolen documents to WikiLeaks. GRU officers communicated with WikiLeaks members about 
the transfers using online personas created by the GRU, including “Guccifer 2.0” and 
“DCLeaks.” (GRU officers separately used these personas to release some of the stolen 
documents). 

21. On or about July 22, 2016, WikiLeaks released tens of thousands of documents 
stolen from the DNC network. These stolen documents included communications by senior 
DNC officials about campaign strategy, financial and fundraising data, and other documents 
related to the 2016 U.S. federal elections, including the 2016 U.S. presidential election. 

pad Beginning in or around October 2016, WikiLeaks began to release tens of 
thousands of emails and documents stolen from Podesta’s email account. Between on or about 
October 7, 2016 and November 7, 2016, WikiLeaks released approximately 33 tranches of 
documents that had been stolen from John Podesta, releasing a total of over 50,000 documents. 

D. Stone’s Communications About WikiLeaks During the Campaign 

23. ‘In April 2018 interviews with the Special Counsel’s Office, Richard Gates stated 
that starting in or around May 2016, when Gates was a senior official on the Trump campaign, 
Stone informed members of the Trump Campaign that WikiLeaks had emails from then- 
candidate Hillary Clinton. According to Gates, after the July 22, 2016 release of stolen DNC 
emails by WikiLeaks, Gates observed a conversation between Manafort and Stone in which they 


discussed WikiLeaks and Stone’s prediction of the release. 
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24. According to Gates, Manafort directed Gates to contact Stone about any 
additional releases and what other information WikiLeaks had regarding the Clinton Campaign. 
Gates contacted Stone, who made statements claiming that there would be potential future 
releases of damaging material by WikiLeaks. In a separate interview with the Special Counsel’s 
Office in or around October 2018, Gates recalled that at one point during the campaign he was 
with then-candidate Trump in a car when the candidate had a telephone call with Stone; shortly 
after finishing the call with Stone, Gates recalled then-candidate Trump said more leaks were 
coming. 

25. Emails recovered through a court-authorized search of Stone’s email account 
GED show that shortly after the July 22, 2016 release of stolen DNC emails 
by WikiLeaks, Stone corresponded with other associates about contacting WikiLeaks in order to 
obtain other emails damaging to the Clinton Campaign: 

a. On or about July 25, 2016, Stone sent an email to Jerome Corsi with the subject 
line, “Get to Assange.” The body of the message read, “Get to Assange [a]t 
Ecuadorian Embassy in London and get the pending WikiLeaks emails... they 
deal with Foundation, allegedly.” On or about the same day, Corsi forwarded 
Stone’s email to B. who lived in the United Kingdom and who was a 
supporter of the Trump Campaign. 


? A search of was authorized on or about September 11, 2017 by the 
U.S. District Court for the District of Columbia. Case No. 1:17-mj-661 (D.D.C. Sept. 11, 2017). 


A second search of i was authorized on or about August 3, 2018 by the 
U.S. District Court for the District of Columbia. Case No. 1:18-sc-2582 (D.D.C. Aug. 3, 2018). 
On or about September 26, 2018, the government obtained and executed an order pursuant to 18 
U.S.C. § 2703(d) for records connected to SM. Case No. 1:18-sc-2911 
(D.D.C. Sept. 26, 2018). Records provided in response by Microsoft Corporation confirmed that 
the account was still active and that the relevant emails described in this affidavit were not 
deleted from the account. 
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b. On or about July 31, 2016, Stone emailed Corsi with the subject line, “Call me 
MON.” The body of the email read in part that J “should see Assange.” 

c. On or about August 2, 2016, Corsi responded to Stone by email and wrote that he 
was currently in Europe and planned to return in mid-August. Corsi stated, “Word 
is friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in Oct. 
Impact planned to be very damaging.” In a law enforcement interview, Corsi 
stated that the phrase “friend in embassy” referred to Assange. Corsi added in the 
same email, “Time to let more than Podesta to be exposed as in bed w enemy if 
they are not ready to drop HRC. That appears to be the game hackers are now 
about. Would not hurt to start suggesting HRC old, memory bad, has stroke — 
neither he nor she well. I expect that much of next dump focus, setting stage for 
Foundation debacle.” 

26. | According to recorded public statements recovered by the FBI, starting in early 
August 2016, after receiving this August 2, 2016 email from Corsi, Stone made repeated 
statements about information he claimed to have learned from Assange: 

a. According to a public video posted to YouTube, on or about August 8, 2016, 
Stone attended a public event in Broward County, Florida. During the event, 
Stone stated, “I actually have communicated with Assange. I believe the next 
tranche of his documents pertain to the Clinton Foundation, but there’s no telling 
what the October surprise may be.” 

b. According to a public video posted to YouTube, on or about August 12, 2016, 


Stone was interviewed for a video segment on the show InfoWars, hosted by Alex 
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Jones. During the interview, Stone stated that he was “in communication with 
Assange” but was “not at liberty to discuss what I have.” 

c. According to a public video posted to YouTube, on or about August 16, 2016, 
Stone stated during another interview with Alex Jones that “it became known on 
this program that I have had some back-channel communications with WikiLeaks 
and Assange.” In a second interview on or about the same day with Dana Loesch 
of the TheBlaze TV, Stone stated that he “communicated with Mr. Assange” and 
that they had a “mutual acquaintance who is a fine gentleman.” 

d. According to a video posted to the public website of the TV station C-SPAN, 
during a C-SPAN television interview on or about August 18, 2016, Stone stated 
that he had communicated with Assange through an “intermediary, somebody 
who is a mutual friend.” 

e. In or around late 2018, Credico voluntarily produced to the FBI a copy of a radio 
interview he did with Stone on or about August 23, 2016 during which the two 
discussed Stone’s prior claims to be in contact with Assange. At one point during 
the interview, Credico asked Stone, “You’ve been in touch indirectly with 
Assange. Can you give us any kind of insight? Is there an October surprise 
happening?” Stone responded, “Well, first of all, I don’t want to intimate in any 
way that I control or have influence with Assange because I do not.... We have 
a mutual friend, somebody we both trust and therefore I am a recipient of pretty 
good information.” 


27. In or around November 2018, (qq | Stone 


produced a series of text messages between Stone and Credico during the 2016 presidential 
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campaign.° 


These text messages show that, beginning on or about August 19, 2016, Stone 


exchange written communications with Credico about what WikiLeaks and Assange planned to 


do. Emails recovered through a court-authorized search of Stone’s email account 


SS show additional written communications between Stone and Credico 


about WikiLeaks in or around September 2016. 


a. 


On or about August 19, 2016, Credico sent a text message to Stone that read in 
part, “I’m going to have Julian Assange on my show next Thursday.” On or 
about August 21, 2016, Credico sent another text message to Stone, writing in 
part, “I have Julian Assange on Thursday so I’m completely tied up on that day.” 
On or about August 25, 2016, Assange was a guest on Credico’s radio show for 
the first time. On or about August 26, 2016, Credico sent a text message to Stone 
that stated, “Assange talk[ed] about you last night.” Stone replied and asked what 
Assange said, to which Credico responded, “He didn’t say anything bad we were 
talking about how the Press is trying to make it look like you and he are in 
cahoots.” 

On or about August 27, 2016, Credico sent text messages to Stone that said, “We 
are working on a Julian Assange radio show,” and that he (Credico) was “in 
charge” of the project. In a text message sent later that day, Credico added, 
“Julian Assange has kryptonite on Hillary.” 

On or about September 18, 2016, Stone sent a text message to Credico that said, 


“I am e-mailing u a request to pass on to assange.” Credico responded “Ok,” and 


> As discussed below, Stone had previously released some of these text messages to members of 
the media, who had written about them and published them in part. 
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added in a later text message, “Just remember do not name me as your connection 
to Assange you had one before that you referred to.” 

e. Later on or about September 18, 2016, Stone emailed Credico an article with 
allegations against then-candidate Clinton related to her service as Secretary of 
State. Stone stated, “Please ask Assange for any State or HRC e-mail from 
August 10 to August 30 -- particularly on August 20, 2011 that mention [the 
subject of the article] or confirm this narrative.” 

f. On or about September 19, 2016, Stone texted Credico again, writing, “Pass my 
message .. . to Assange.” Credico responded, “I did.” On or about September 
20, 2016, Credico forwarded the request to a close friend who was an attorney 
with the ability to contact the Assange. Credico blind-copied Stone on the 
forwarded email. 

g. On or about September 30, 2016, Credico sent Stone via text message a 
photograph of Credico standing outside the Ecuadorian Embassy in London 
where Assange was located. 

h. On or about October 1, 2016, which was a Saturday, Credico sent Stone text 
messages that stated, “big news Wednesday .. . now pretend u don’t know me... 
Hillary’s campaign will die this week.” In the days preceding these messages, the 
press had reported that Assange planned to make a public announcement on or 
about Tuesday, October 4, 2016, which was reported to be the 10-year 


anniversary of the founding of WikiLeaks. 
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i. On or about October 2, 2016, Stone emailed Credico, with the subject line 
“WTF?” and a link to an article at the website http://heatst.com/politics/october- 
surprise-thwarted-wikileaks-cancels-highly-anticipated-tuesday-announcement- 
due-to-security-concerns. Credico responded to Stone, “head fake.” 
j. On or about Monday, October 3, 2016, Stone wrote Credico and asked, “Did 
Assange back off.” Credico initially responded, “I can’t tal[k] about it.” After 
further exchanges with Stone, Credico responded, “I think it[’]s on for 
tomorrow.” Credico added, “Off the Record Hillary and her people are doing a 
full-court press they [sic] keep Assange from making the next dump . . . That’s all 
I can tell you on this line... Please leave my name out of it.” 
28. Emails and text messages recovered by the FBI show that, in or around October 
2016, Stone made statements about Assange’s future releases that were similar to prior 
statements made by Credico to him. For example: 
a. In acourt-authorized search of Stone’s email account (ND the 
FBI recovered an email from Stone to ito] sent on or about October 3, 2016, 
which stated in part, “Spoke to my friend in London last night. The payload is 
still coming.” 
b. In a court-authorized search of MM, the FB! also recovered an 
email exchange from on or about October 3, 2016 between Stone and a reporter 


who had connections to Bannon. In the exchange, the reporter asked, “Assange — 


“A search of i was authorized on or about October 17, 2017 by the U.S. 
District Court for the District of Columbia. Case No. 1:17-mj-760 (D.D.C. Oct. 17, 2017). A 
second search of I was authorized on or about August 3, 2018 by the U.S. 
District Court for the District of Columbia. Case No. 1:18-sc-2583 (D.D.C. Aug. 3, 2018). 
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29: 


what’s he got? Hope it’s good.” Stone responded, “It is. I’d tell Bannon but he 
doesn’t call me back.” 

On or about October 4, 2016, Assange held a press conference but did not release 
any new materials pertaining to the Clinton Campaign. In a court-authorized 
search of I. the FBI recovered an email exchange between 
Stone and Steve Bannon on or about October 4, 2016 that occurred after the press 
conference. In the exchange, Bannon asked, “What was that this morning???”, 
referring to Assange’s press conference. Stone responded, “Fear. Serious security 
concern. He thinks they are going to kill him and the London police are standing 


do[wn]. However — a load every week going forward.” 


. In a court-authorized search of Stone’s iCloud account,’ the FBI recovered text 


messages between Stone and [J from on or about October 4, 2016. In one 
text message, J asked Stone if he had “hear[d] anymore from London.” 
Stone replied, “Yes — want to talk on a secure line — got Whatsapp.” In an 
interview with the Special Counsel’s Office in or around May 2018, Prince 
confirmed that he and Stone spoke and that Stone had told him WikiLeaks had 
more material to release, and that the material was related to senior people 
associated with Clinton. 


On or about October 7, 2016, WikiLeaks released the first set of emails stolen 


from Podesta. According to text messages recovered from Stone’s iCloud account, shortly after 


the release, an associate of Bannon sent a text message to Stone that read “well done.” Similarly, 


> A search of Stone’s iCloud account was authorized on or about March 14, 2018 by the U.S. 
District Court for the District of Columbia. Case No. 1:18-sc-662 (D.D.C. Mar. 14, 2018). The 
records for Stone’s iCloud account contained some, but not all, of Stone’s communications from 
the campaign period. 
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during an April 2018 interview, Gates recalled that after the October 7, 2016 WikiLeaks release, 
Stone said, “I told you this was coming.” 


E. Stone’s Communications with the House Permanent Select Committee on 
Intelligence 


30. On or about January 25, 2017, HPSCI publicly disclosed that it was investigating 
allegations of Russian interference in the 2016 presidential election and possible links to 
individuals associated with political campaigns.° During a public HPSCI hearing on or about 
March 20, 2017, multiple HPSCI committee members indicated that Stone’s prior public 
statements about having communications with Assange (particularly those from August 2016) 
were of interest to the committee. 

31. In or around May 2017, HPSCI sent a letter requesting that Stone voluntarily 
appear before the committee and produce relevant documents to HPSCI (a copy of the HPSCI 
letter was recovered by the FBI from a court-authorized search of Stone’s email account 


E) Whe letter requested Stone produce: 


Any documents, records, electronically stored information 
including e-mail, communication, recordings, data and tangible 
things (including, but not limited to, graphs, charts, photographs, 
images and other documents) regardless of form, other than those 
widely available (e.g., newspaper articles) that reasonably could 
lead to the discovery of any facts within the investigation's 
publicly-announced parameters. 


32. On or about May 22, 2017, counsel for Stone responded to HPSCI in writing and 
stated that “Mr. Stone has no documents, records, or electronically stored information, regardless 


of form, other than those widely available that reasonably could lead to the discovery of any 


é On or about January 13, 2017, the chairman and vice chairman of the Senate Select Committee 
on Intelligence (““SSCI”) announced the committee would conduct an inquiry that would 
investigate, among other things, any intelligence regarding links between Russia and individuals 
associated with political campaigns, as well as Russian cyber activity and other “active 
measures” directed against the United States in connection with the 2016 election. 
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facts within the investigation’s publicly-announced parameters.” (A copy of the letter was 
recovered from a court-authorized search of Stone’s email account ). 
F. Stone’s Testimony Before HPSCI 

33. On or about September 26, 2017, Stone provided HPSCI with an “opening 
statement” that his counsel requested be included as part of the record of proceedings before 
HPSCI. In his opening statement, which HPSCI provided to the Department of Justice,’ Stone 
stated, “These hearings are largely based on a yet unproven allegation that the Russian state is 
responsible for the hacking of the DNC and John Podesta and the transfer of that information to 
WikiLeaks.” 

34. Also on or about September 26, 2017, Stone provided testimony in a closed 
session before HPSCI, at the U.S. Capitol in Washington, D.C. Stone’s testimony was 
transcribed, and a copy of the transcript was obtained by the Special Counsel’s Office from 
HPSCI in or around December 2018. Stone appeared before HPSCI under oath and affirmed for 
the record that he would tell the truth. At the beginning of the hearing, Stone was admonished 
that “it is unlawful to deliberately provide false information to Members of Congress or staff” 
and that “providing false information to this committee or concealing material information from 
this committee is a crime punishable by law.” 

Stone's Testimony About Documents He Possessed Related to WikiLeaks 
35. During his HPSCI testimony, Stone was asked about HPSCI’s May 2017 


document request and whether Stone had any documents or written communications that 


7 On or about December 14, 2018, the U.S. Department of Justice requested the transcript of 
Stone’s interview with HPSCI, as well as any written submissions and/or correspondence from 
Stone and/or his counsel before or after the interview. On or about December 20, 2018, HPSCI 
provided the U.S. Department of Justice a copy of the transcript of the September 26, 2017 
interview of Roger Stone, a copy of Stone’s written opening statement, and various 
correspondence from Stone’s counsel to members of HPSCI. 
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discussed Julian Assange, Russian interference, or other relevant documents: 


Q: The committee wrote to you on May 9th requesting no later 
than May 22 any documents, records, electronically stored 
information, including email communication, recordings, 
data, and other tangible things relevant to our investigation, 
You wrote back through counsel that you had no 
documents, records, or electronically stored information 
regardless of form responsive to our requests. Was that a 
false statement? 


A: That is not a false statement. That’s what -- I believe that 
to be true. 

beel 

Q: So you have no emails to anyone concerning the allegations 


of hacked documents or your conversations with the 
Guccifer 2[.0] or any discussions you have had with third 
parties about Julian Assange? You have no emails, no texts, 
no documents whatsoever, any kind of that nature? 


A: That is correct. Not to my knowledge. I think we met, 
again, the precise criteria of your request, and we complied. 
Again, if you have a more specific request, I'm happy to go 
back and look. ... 


Q: I just want to ask you under oath — 


We did an extensive search consistent with the direction of 
my attorneys, and we found nothing that met the criteria 
that you asked for. 


Q: I just want to be certain because you are under oath, where 
your letter was not under oath, that you have no documents, 
no emails, no texts, no tweets that refer to Julian Assange 
or Guccifer 2[.0] or Paul Manafort or the allegations 
concerning Russian connections with the campaign. You 
have had no discussions in any written form. You've 
written no documents yourself. 


A: In connection with Russian collusion, consistent with your 
exact and precise request, yes. 


36. In fact, and as described above, Stone had sent and received numerous emails and 


text messages during the 2016 campaign in which he discussed WikiLeaks, Assange, and 
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WikiLeaks possession of hacked emails. Court-authorized searches of Stone’s email accounts 
a i his iCloud account show 
that, at the time of his testimony, Stone was still in possession of many of these emails and text 
messages at the time he testified on or about September 22, 2017.8 These written 
communications included (a) Stone’s email to Corsi on or about July 25, 2016 that read in part, 
“Get to Assange [a]t Ecuadorian Embassy in London and get the pending WikiLeaks emails... 
they deal with Foundation, allegedly.”; (b) Stone’s email to Corsi on or about July 31, 2016 that 
GE “should see Assange”; (c) Corsi’s email to Stone on or about August 2, 2016 that stated 
in part, “Word is friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in 
Oct. Impact planned to be very damaging.”; (d) dozens of text messages and emails between 
Stone and Credico, beginning on or about August 19, 2016 and continuing through duration of 
the election, in which they discussed WikiLeaks and Assange; (e) Stone’s email to [J on or 
about October 3, 2016 that read in part “Spoke to my friend in London last night. The payload is 
still coming.”; and (f) Stone’s email to Bannon on or about October 4, 2016 that claimed 
WikiLeaks would release “‘a load every week going forward.” 
Stone's Testimony About His Early August 2016 Statements 

37. | During his HPSCI testimony on or about September 26, 2017, Stone was asked to 

explain his statements in early August 2016 about being in contact with Assange. Stone was 


specifically asked about his statement on or about August 8, 2016 that “I’ve actually 


8 The warrant for Stone’s email account J was obtained on or about 


September 11, 2017 and executed shortly thereafter. Records provided in or around September 
2018 in response to a court order issued pursuant to 18 U.S.C. § 2703(d) confirmed that the 
account was active and the emails in question were not deleted from the account. The warrant 
for Stone’s email account was obtained on or about October 17, 2017 and 
executed shortly thereafter. The warrant for Stone’s iCloud account (which contained the text 
messages described above) was obtained on or about March 14, 2018 and executed shortly 
thereafter. 


Page 17 of 46 


Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 29 of 57 


communicated with Assange,” as well as his statement on or about August 12, 2016 that he was 
“in communication with Assange” but was “not at liberty to discuss what I have.” 

38. Stone testified that these public references to having a means of contacting 
WikiLeaks referred exclusively to his contact with a journalist, who Stone described as a “go- 
between, as an intermediary, as a mutual friend” of Assange. Stone declined to tell HPSCI the 
name of this “intermediary,” but he provided a description in his testimony that was largely 
consistent with Credico. (On or about October 13, 2017, Stone caused a letter to be submitted to 
HPSCI that identified Credico by name as the “gentleman who confirmed for Mr. Stone” that 
Assange had “‘[e]mails related to Hillary Clinton which are pending publication.””). 

39. In fact, documents recovered during the investigation (including those obtained 
via search warrant returns B QM) show that Stone did not begin 
communicating with Credico about Assange or WikiLeaks until on or about August 19, 016 — 
approximately eleven days after Stone first claimed on or about August 8, 2016 to “actually have 
communicated with Assange” and a week after his August 12, 2016 statements of being “in 
communication with Assange” and “not at liberty to discuss what I have.” 

40. | When interviewed by the FBI, Credico stated that the first time he ever spoke 
with Assange was on or about August 25, 2016, when Credico interviewed Assange." Credico 
also provided the FBI with partially redacted emails that he claimed were between he and 


another member of WikiLeaks from on or about August 25, 2016, in which the two discuss the 


? As described above, on or about August 19, 2016, Credico informed Stone by text message that 
Credico intended to interview Assange the following week. On or about August 25, 2016, 
Credico interviewed Julian Assange for the first time, and on or about August 27, 2016, Credico 
texted Stone that “Assange has kryptonite on Hillary.” 


10 Credico was first interviewed by the FBI in or around August 2018. He has subsequently 


participated in multiple voluntary interviews, Illa 


Page 18 of 46 


Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 30 of 57 


technical logistics for the interview later that day. During the exchange, Credico offered 
biographical information about himself, apparently as a means of introduction. 

41. The FBI has not identified any communications between Stone and Credico from 
August 2016 in which Stone directs Credico to contact Assange or WikiLeaks. When 
interviewed by the FBI, Credico claimed he was never directed by Stone in August 2016 to 
contact WikiLeaks. 

42. In contrast, and as described above, the FBI has identified written 
communications prior to August 8, 2016 in which Stone directed Corsi—not Credico—to contact 
Assange. On or about July 25, 2016, for example, Stone wrote to Corsi, “Get to Assange [a]t 
Ecuadorian Embassy in London and get the pending WikiLeaks emails . . . they deal with 
Foundation, allegedly.” Similarly, on or about August 2, 2016, Corsi—not Credico—sent an 
email to Stone in which Corsi wrote that “[w]ord is friend in embassy plans 2 more dumps,” 
including one in October. These communications occurred days before Stone’s first public 
statement on or about August 8, 2016 claiming to be in communication with Assange. However, 
at no time did Stone identify Corsi to HPSCI as another individual Stone contacted to serve as a 
“go-between,” “intermediary,” or other source for information from WikiLeaks. Similarly, 
Stone also never disclosed his written communications with Corsi to HPSCI when answering 
HPSCI’s questioning about the August 8, 2016 and August 12, 2016 statements about being in 


communication with Assange. 


Stone ’s Testimony About Communications to Assange 


43. During his HPSCI testimony, Stone was asked, “Did you ask [the intermediary] to 


communicate anything else to Assange?” Stone responded, “I did not.” Stone was then asked, 
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“Did you ask [the intermediary] to do anything on your own behalf?” Stone responded, “I did 
not.” 

44, In fact, starting on or about September 18, 2016, Stone directed Credico to pass 
on a request to Assange for documents that Stone believed would be damaging to the Clinton 
Campaign. 

a. According to text messages «oon or about 
September 18, 2016, Stone sent a text message to Credico that said, “I am e- 
mailing u a request to pass on to Assange.” On or about the same day, Stone 
emailed Credico an article with allegations against then-candidate Clinton related 
to her service as Secretary of State. Stone added, “Please ask Assange for any 
State or HRC e-mail from August 10 to August 30 — particularly on August 20, 
2011 that mention [the subject of the article] or confirm this narrative.” (A copy 
of this email was obtained through a search of Stone’s email account 
a . 

b. According to text messages I. on or about 


September 19, 2016, Stone texted Credico again, writing “Pass my message . . . to 
Assange.” Credico responded, “I did.” An email obtained from the account 
EE Shows that on or about September 20, 2016, Credico 
forwarded the request to an attorney who had the ability to contact Assange; 
Credico blind copied Stone on the same email. 
Stone's Testimony About Written Communications with Credico 
45. During his HPSCI testimony, Stone was asked repeatedly about his 


communications with the person he identified as his intermediary. Stone stated that he had never 
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communicated with his intermediary in writing in any way. During one exchange, Stone claimed 


only to have spoken with the intermediary telephonically: 


Q: [H]ow did you communicate the intermediary? 
A: Over the phone. 


Q: And did you have any other means of communicating with 
the intermediary? 


A: No. 
Q: No text messages, no — none of the list, right? 
A: No. 


Later during his testimony, Stone again denied ever communicating with his intermediary in 


writing: 


46. 


Q: So you never communicated with your intermediary in 
writing in any way? 


A: No. 

Q: Never emailed him or texted him? 
A: He’s not an email guy. 
Q: 


So all your conversations with him were in person or over 
the phone. 


A: Correct. 


As described above, Stone and Credico (whom Stone identified as his 


intermediary) engaged in frequent written communication by email and text message. Beginning 


on or about August 19, 2016, and continuing through the 2016 U.S. presidential election, Stone 


and Credico engaged in dozens of communications by email or text message in which they 


discussed WikiLeaks and the possible release of stolen documents that would be damaging to the 


Clinton Campaign. 
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47, Written communications between Stone and Credico continued up until Stone’s 
HPSCI testimony and afterwards. For example, on or about September 26, 2017—the day that 
Stone testified before HPSCI and denied having ever sent or received emails or text messages 
from his identified intermediary—Stone and Credico exchanged over thirty text messages. 

48. Certain of the electronic messages between Stone and Credico (which Stone 
denied ever taking place or possessing) would have been material to HPSCI, including Stone’s 
messages in or around September 2016 directing Credico to pass a request for documents to 
Assange, and other relevant written communications with Credico. For example, on or about 
January 6, 2017, Credico sent Stone an email, which Stone had in his possession at the time of 
his HPSCI testimony, that had the subject line “Back channel bs.” In the email, Credico wrote, 
“Well I have put together timelines[] and you [] said you have a back-channel way back a month 
before I had Assange on my show... I have never had a conversation with Julian Assange other 
than my radio show . . . I have pieced it all together . . . so you may as well tell the truth that you 


had no back-channel or there’s the guy you were talking about early August.” (A copy of this 


email was obtained through a search of Stone’s email account yy). 
Stone's Testimony About Communications with the Trump Campaign 


49. During his HPSCI testimony, Stone was asked, “[d]id you discuss your 
conversations with the intermediary with anyone involved in the Trump campaign?” Stone 
answered, “I did not.” As described above, Stone spoke to multiple individuals involved in the 
Trump campaign about what he claimed to have learned from his intermediary to Assange, 


including the following: 
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a. As described above, Gates confirmed to investigators that Stone spoke with senior 
Trump Campaign officials by telephone to inform them about materials possessed 
by Assange and the timing of future releases. 

b. According to text messages I. on or about 
October 3, 2016, Stone wrote to J, “Spoke to my friend in London last night. 
The payload is still coming.” 

c. As described above, on or about October 4, 2016, after receiving information 
from Credico about the delay in WikiLeaks’s release of stolen materials, Stone 
emailed Bannon that Assange had a “[s]erious security concern” but would 
release “a load every week going forward.” 

G. Stone’s Attempts to Influence Credico Regarding HPSCI and the FBI 

50. According to an email recovered through a court-authorized search of Stone’s 
email account MB, on or about October 19, 2017, Stone sent Credico an 
excerpt of his October 13, 2017 letter to HPSCI in which Stone claimed Credico was his 
“intermediary” to Assange. As described below, Credico repeatedly told Stone that his letter was 
false and said he should correct his statement to HPSCI, but Stone did not do so. Stone then 
engaged in a prolonged effort to prevent Credico from contradicting Stone’s false statements to 
HPSCI. 

51. In or around November 2017, Credico received a request from HPSCI to testify 


voluntarily before the committee. After being contacted by HPSCI, Credico spoke and texted 


repeatedly with Stone, [ie 
E O Ol 
E a 
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a. 


On or about November 19, 2017, Credico texted Stone that his lawyer wanted to 
see him. Stone responded, “‘Stonewall it. Plead the fifth. Anything to save the 
plan’... Richard Nixon.” (A copy of these text messages was recovered through 
a court-authorized search of Stone’s iCloud account). On or about November 20, 
2017, Credico informed HPSCI that he declined HPSCI’s request for a voluntary 
interview. 

On or about November 21, 2017, Credico texted Stone, “I was told that the house 
committee lawyer told my lawyer that I will be getting a subpoena.” Stone 
responded, “That was the point at which your lawyers should have told them you 
would assert your 5th Amendment rights if compelled to appear.” (A copy of 
these text messages was recovered through a court-authorized search of Stone’s 
iCloud account). 

On or about November 28, 2017, Credico received a subpoena compelling his 


testimony before HPSCI. Credico informed Stone of the subpoena. 


. According to emails recovered from  Stone’s email account 


RS. o or about November 30, 2017, Stone asked Corsi to 


write publicly about Credico. Corsi responded, “Are you sure you want to make 
something out of this now? Why not wait to see what [Credico] does? You may 
be defending yourself too much — raising new questions that will fuel new 
inquiries. This may be a time to say less, not more.” Stone responded by telling 


Corsi that Credico “will take the Sth—but let’s hold a day.” 
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52, 


e. 


According to text messages recovered from Stone’s iCloud account, on multiple 
occasions, starting on or about November 17, 2017, Stone and Credico discussed 
Frank Pentangeli. Frank Pentangeli is a character in the film The Godfather: Part 
II, who falsely claims not to know critical information before a congressional 
committee that he does in fact know. On or about December 1, 2017, Stone told 
Credico in a text message to “Start practicing your Pentagele.” When interviewed 
by the FBI, Credico confirmed that he understood Stone’s references to Frank 
Pentangeli to be Stone’s way of suggesting Credico withhold relevant information 
from investigators. 

On or about December 1, 2017, Stone texted Credico, “And if you turned over 
anything to the FBI you’re a fool.” Later that day, Credico texted Stone, “You 
need to amend your testimony before I testify on the 15th.” Stone responded, “If 
you testify you’re a fool. Because of tromp I could never get away with a certain 
[sic] my Fifth Amendment rights but you can. I guarantee you you are the one 
who gets indicted for perjury if you’re stupid enough to testify.” (A copy of these 
text messages was recovered through a court-authorized search of Stone’s iCloud 
account). 


On or about December 12, 2017, Credico informed HPSCI that he intended to 


assert his Fifth Amendment privilege against self-incrimination if required to appear by 


subpoena. According to Credico, he invoked his Fifth Amendment privilege in part to avoid 


providing evidence that would show Stone’s previous testimony to Congress was false. 


53. 


Following Credico’s invocation of his Fifth Amendment privilege not to testify 


before HPSCI, Stone and Credico continued to have discussions about the various investigations 
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into Russian interference in the 2016 election and what information Credico would provide to 


investigators. During these conversations, Stone repeatedly made aggressive statements intended 


to prevent Credico from cooperating with the investigations. For example: 


a. 


On or about December 24, 2017, Credico texted Stone, “I met assange for ffi]rst 
time this yea[r|] sept 7 .. . docs prove that . . . You should be honest w fbi. . 
there was no back channel . . . be honest.” Stone replied approximately two 
minutes later, “I’m not talking to the FBI and if your smart you won’t either.” (A 
copy of these text messages was recovered through a court-authorized search of 
Stone’s iCloud account). 

On or about April 9, 2018, Stone wrote in an email to Credico, “You are a rat. 
You are a stoolie. You backstab your friends—run your mouth my lawyers are 
dying Rip you to shreds.” Stone also said he would “take that dog away from 
you,” referring to Credico’s dog. On or about the same day, Stone wrote to 
Credico, “I am so ready. Let’s get it on. Prepare to die [expletive].” (A copy of 
this email exchange was recovered through a court-authorized search of Stone’s 
email accoun. 

On or about May 21, 2018, Credico wrote in an email to Stone, “You should have 
just been honest with the house Intel committee ... you’ve opened yourself up to 
perjury charges like an idiot.” Stone responded, “You are so full of [expletive]. 
You got nothing. Keep running your mouth and I'll file a bar complaint against 
your friend [the attorney who had the ability to contact the head of Assange].” 


(A copy of this email exchange was recovered through a court-authorized search 


of Stone’s email account MM). Credico believed Stone knew 
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that Credico was sensitive to having this friend’s name publicly disclosed. 
H. Missing Electronic Communications and Stone’s Use of Encrypted Communications 

54. As described above, the government has recovered the content of many of Stone’s 
electronic communications from summer and fall of 2016 (during the period of the U.S. 
presidential election) and afterward (during the period of pending congressional investigations 
into Russian interference in the U.S. election). However, the government is aware of the 
existence of numerous other relevant electronic communications, the content of which it has not 
yet been able to recover. 

55. As described above, during his HPSCI testimony, Stone falsely denied having 
emailed or exchanged text messages with his “intermediary” (later identified by Stone as Randy 
Credico). In fact, emails and text messages recovered in this investigation show the two 
communicated frequently by email and text messages; court-authorized searches of Stone’s 
email and iCloud accounts confirm that Stone still had those communications at the time he 
testified in or around September 2017. In numerous communications, Stone and Credico 
discussed Julian Assange and WikiLeaks, as well as Stone’s suggestion that Credico was his 
intermediary to Assange. These communications appear relevant and responsive to HPSCI’s 
inquiry, but Stone never disclosed them. 

56. In addition to these emails and text messages in the FBI’s possession, the FBI has 
reviewed telephone billing records for Stone’s cellular telephone for the years 2016 and 2017, 
and they show text message communications whose content that the government to date has not 
been able to obtain. For example, these records indicate that Stone and Credico alone exchanged 
thousands of text messages (including over 1,500 text messages between the period November 


2016 and December 2017) the substance of which the government to date has not recovered or 
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reviewed, The government has only recently obtained text messages between Stone and Credico 
during some period of the campaign in 2016 from Stone’s subpoena production, issued after 
media reports in November 2018 stated that Stone’s attorneys were able to extract text messages 
between Stone and Credico from a phone Stone stopped using in 2016. But the government does 
not have, for the same time period, many of Stone’s other text messages. The government seeks 
these text messages believing they may show additional evidence of (1) the falsity of Stone’s 
HPSCI testimony concerning his communications with his “intermediary” and (2) efforts to 
corruptly persuade Credico not to cooperate with pending investigations. 

57. Additionally, the FBI has interviewed multiple associates of Stone, who 
confirmed that Stone has used encrypted applications to communicate with others. Similarly, 
records obtained in this investigation indicate Stone uses multiple applications designed for 


encrypted communication, including (a) WhatsApp,'' (b) Signal,'? (c) Wickr,'? and (d) 


l! According to open sources, WhatsApp is an application that allows the user to send text 
messages, make voice calls, and transmit documents. WhatsApp uses end-to-end encryption and 
stores its messages separately from those text messages used on a mobile device’s default 
message application. 


'? According to open sources, Signal is an encrypted communications application allowing the 
user to send one-to-one and group messages, which can include files, voice notes, images and 
videos, and make one-to-one voice and video calls. Signal uses standard cellular mobile 
numbers as identifiers, and uses end-to-end encryption to secure all communications to other 
Signal users. Signal also allows users to set timers to messages, after which the messages will be 
deleted from both the sender’s and the receivers’ devices. 


3 According to open sources, Wickr is an instant messaging application that allows users to 
exchange end-to-end encrypted and content-expiring messages, including photos, videos, and file 
attachments and place end-to-end encrypted video conference calls. Like Signal, Wickr allows 
users to set an expiration time for their encrypted communications. In addition to encrypting 
user data and conversations, Wickr claims that its application strips metadata from all content 
transmitted through the network. 


Page 28 of 46 


Case 1:19-mc-00029-CRC Document 29-34 Filed 04/28/20 Page 40 of 57 


ProtonMail.'* To date, the FBI has not obtained any of Stone’s communications conducted 
through these applications. 
a. According to records from Stone’s iCloud account, a copy of the WhatsApp 
application was downloaded to an iPhone registered to Stone on or about October 
5, 2016. As described above, on or about October 4, 2016, Stone suggested in an 
email to J that they “talk on a secure line” and proposed using 
WhatsApp. 
b. According to records from Stone’s iCloud account, a copy of the Signal 
application was downloaded to an iPhone registered to Stone on or about August 
18, 2016. Additionally, text messages recovered from Stone’s iCloud account 
revealed that on or about November 15, 2016, Stone sent an attorney with the 
ability to contact Julian Assange a link to download the Signal application.’ 
Approximately fifteen minutes after sending the link, Stone texted the attorney, 
“Pm on signal just dial my number.” The attorney responded, “P11 call you.” 
c. According to records from Stone’s iCloud account, a copy of the ProtonMail 
application was downloaded to an iPad registered to Stone on or about August 18, 


2016. 


4 According to open sources, ProtonMail is an end-to-end encrypted email service that uses 
client-side encryption to protect email contents and user data before they are sent to ProtonMail 
servers. According to its website, ProtonMail is run by Proton Technologies AG, a company 
based in the Canton of Geneva, and its servers are located at two locations in Switzerland, 
outside of US and EU jurisdiction. 


'S This attorney was a close friend of Credico’s and was the same friend Credico emailed on or 


about September 20, 2016 to pass along Stone’s request to Assange for emails connected to the 
allegations against then-candidate Clinton related to her service as Secretary of State. 
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d. According to records from Stone’s iCloud account, a copy of the Wickr 
application was downloaded to an iPhone registered to Stone on or about August 
5, 2017. 

58. Based on my training and experience, electronic communications using encrypted 
applications such as WhatsApp, Signal, ProtonMail, and Wickr are sometimes maintained on the 
device used to send and receive those communications. Communications from those 
applications can be obtained by law enforcement by searching the device either manually or via a 
data extraction device (such as Cellebrite). Searches of the physical device can reveal messages, 
including text messages and messages exchanged over WhatsApp, Signal, ProtonMail, and 
Wickr, that have not been backed up to cloud accounts (such as an iCloud account). 
Additionally, review of the device and the downloaded application can reveal other evidence of 
encrypted communications, such as call logs and contact lists. 

59. The FBI continues to seek evidence of Stone’s communications and contacts 
during the period of the 2016 U.S. presidential election and through the present. The FBI 
believes these communications may contain evidence of additional communications concerning 
Assange, WikiLeaks, and the release of stolen documents damaging to the Clinton Campaign. 
Such communications could constitute additional evidence of Stone’s efforts to obstruct 
HPSCI’s investigation by showing additional contacts and communications about Assange and 
WikiLeaks that Stone failed to disclose. 

I. Other Relevant Records 
60. On or about May 8, 2018, a law enforcement interview of J 


= «.: conducted. 2- an employee of Stone’s from approximately June 2016 


through approximately December 2016 and resided in Stone’s previous New York apartment for 
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a period of time. {provided information technology support for Stone but was not formally 
trained to do so. [was aware that Stone communicated with Trump during the 2016 
presidential campaign, and afterward, both in person and by telephone. {provided 
information about a meeting at Trump Tower between Trump and Stone during the time EEE 
worked for him, to which Stone carried a “file booklet” with him. Stone told {jhe file 
booklet was important and that no one should touch it. Balso said Stone maintained the file 
booklet in his closet. 

61. On or about December 3, 2018, law enforcement conducted an interview of an 
individual (“Person 2”) who previously had a professional relationship with a reporter who 
provided Person 2 with information about Stone. The reporter relayed to Person 2 that in or 
around January and February 2016, Stone and Trump were in constant communication and that 
Stone kept contemporaneous notes of the conversations. Stone’s purpose in keeping notes was to 
later provide a “post mortem of what went wrong.” 

J. The Subject Premises 

62. Your affiant is aware through the investigation that Stone maintains the Subject 
Premises as his personal office and has done so since at least the 2016 Campaign. Public 
reporting indicates that Stone occupied Subject Premises as his office during the 2016 
Campaign.'® An April 17, 2017 news article also described Stone’s “personal office” at a 


location matching the description of the Subject Premises.” 


16 See Roger Stone: Inside The World Of A Political Hitman, CBS Miami, April 17, 2016, 
available at https://miami.cbslocal.com/2016/04/17/roger-stone-inside-the-world-of-a-political- 
hitman/ (“CBS4’s Jim DeFede has known Stone for years and visited him recently at his office in 
a nondescript building in an industrial section of Oakland Park that houses his collection of 
Nixon memorabilia.”’). 


'7 See Roger Stone Helped Donald Trump Get Elected President — Now He’s Helping Himself, 
Washington Post, April 19, 2017, available at https://www.washingtonpost.com/lifestyle/style/ 
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63. According to records recovered from the court-authorized search of Stone’s 
iCloud (discussed above), Stone on or about January 31, 2014 composed a draft email with the 
subject 0o -::: for your signature,” the address of the Subject Premises. 
(The recovered record contained no further content). On or about November 27, 2017, Stone 
sent another individual the address of the Subject Premises while arranging a meeting. 

64. Recovered text messages show that Stone has repeatedly identified the Subject 
Premises as his office. 

a. On or about March 30, 2017, Stone directed another individual to send a reporter 

“to my office.” When the other individual asked ‘“‘address?”, Stone responded, 

aaa in “Oakland park,” which corresponds to the address of the 
Subject Premises. 

b. On or about April 8, 2017, Stone exchanged messages with an individual who 
identified himself as mz a freelance photographer for the Washington 
Post. In the exchange, the photographer wrote he “would like to photograph you 
first thing Tuesday morning ... April 11 if that is convenient.” Stone responded, 


$3 


“Yes — let me figure out where.” The photographer then wrote that “[t]he story 


mentions your office, that would be a good location for me.” Stone replied, 


OoOo D is the address of the Subject Premises. 


roger-stone-a-master-of-dark-political-arts-is-playing-the-russia-scandal-for-all-its-worth (“The 
next part of the directions to his personal office and broadcast studio calls for locating a “door 
discreetly marked ‘A, ” which might be helpful, except for the crucial fact that there is no door 
discreetly marked “A” at the new address next to a bathroom supplies depot. There is, however, 
a blacked-out door with no markings, and the man who emerges from behind it, wearing shorts, 
loafers with no socks, a rakishly loosened tie and an untucked white dress shirt, is unmistakably 
Stone.”). 
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65. In other text messages recovered from Stone’s iCloud, Stone refers to the Subject 
Premises as a “warehouse.” On or about July 25, 2015, Stone wrote another individual, 
“Warehouse has very high speed cable if u want to use ‘getaway office.” On or about 
November 10, 2017, Stone wrote an individual, “U don’t need an office — high speed [inter]net at 
our warehouse avail 24-7.” 

66. On or about May 18, 2018, investigators interviewed an individual (“Person 1”) 
who described himself as Stone’s “right hand man” in the summer of 2016. Person | stated that 
as of May 2018, he worked at least sixty hours a week for Stone. Communications recovered 
from Stone’s account indicate that Stone communicated with Person | for the duration of the 
Campaign and afterwards through May 2018. Those communications included matters related to 
the 2016 Campaign and Stone’s social media presence. 

67. Person 1 told investigators that as of May 2018, he worked either out of Stone’s 
home in Florida or at Stone’s studio in Fort Lauderdale (the Subject Premises). Person 1 further 
stated that Stone currently had computers in the Subject Premises. 

68. During physical surveillance of the Subject Premises on or about January 17, 
2019, the FBI observed Stone enter the Subject Premises. Stone was accompanied by two 
individuals believed to host a podcast. The following photographs of Stone (wearing a light 


button-down shirt and tie) entering the Subject Premises was taken on that date: 
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K. Computer Devices at the Subject Premises 

69. Based on law enforcement interviews, your affiant is aware that Stone has used 
and uses cellular telephones, desktop, and laptop computers to conduct electronic 
communications. Stone also configures his computers to create regulars backups. 

70. As described above, in text messages recovered from Stone’s iCloud account, 
Stone indicated the Subject Premises has high-speed internet service (referred to as having “very 
high speed cable” and “high speed net”). 

Ti As described above, on or about April 8, 2017, Stone and a photographer hired by 


the Washington Post agreed to meet at the Subject Premises on or about April 11, 2017 in order 
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for the photographer to photograph Stone. On or about April 19, 2017, the Washington Post 


published a lengthy article about Stone that featured the following two photographs’: 


i8 “Roger Stone Helped Donald Trump Get Elected President - Now He’s Helping Himself,” 
Washington Post, Apr. 19, 2017, available at https://www.washingtonpost.com/lifestyle/style/ 
roger-stone-a-master-of-dark-political-arts-is-playing-the-russia-scandal-for-all-its-worth/2017/ 
04/18/1518184e-236f-1 1e7-b503-9d616bd5a305_story.html?utm_term=.7576648d5cel. 
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Both photographs were credited to the photographer with the first name ‘S. and the 
caption of the latter photograph read in part, “Stone in his memorabilia-overrun office.” The 
photographs depict, among other things, multiple computer accessories, including a monitor, 
microphone, and printer. 

72. In addition, messages recovered from the court-authorized search of Stone’s 
iCloud account show that since January 1, 2017, Stone has granted interviews over Skype from 
his office, further indicating he likely has a computer present there.'? For example, on or about 
December 13, 2017, Stone coordinated an upcoming interview with another individual by text 
message. Stone confirmed the interview, writing that he would participate via “Skype from our 
Florida studio with green screen.” 

73. In or around May 2018, as discussed above, the FBI interviewed Person 1, who 
worked for Stone. Person 1 told the FBI that Stone maintained a computer at the Subject 
Premises. 

74. In or around May 2018, the FBI interviewed an individual (Person 2) who 
provided information technology services to Stone. Person 2 stated that Stone used the Apple 
Time Machine (“Time Machine”) application to facilitate backups of his computers. According 
to publicly available information, Time Machine is the built-in backup feature of Apple 
computers and can create copies of files on a computer, including applications, music, photos, 
email, documents, and system files. A Time Machine backup allows users to restore files from a 


specific point in time if the original files are ever deleted, or if the hard drive is erased or 


1? According to publicly available information, Skype is a telecommunications application 
software that specializes in providing video chat and voice calls between computers, tablets, 
mobile devices, and similar devices via the internet. 
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replaced. In order to create backups with Time Machine, a user connects an external storage 
device to the computer and selects that external storage device as the backup disk.” 

75. Records produced by AT&T A show that, 
since 2016, Stone has had multiple Apple iPhone devices registered to his personal cellular 
telephone number (ending in B. ^ccording to AT&T, between approximately January 1, 
2015 and November 14, 2016, Stone’s telephone number was registered to an Apple iPhone 
model Ss (“iPhone 5s”) (IMSI 310410657061814). On or about November 14, 2016, Stone’s 
cellular telephone number was transferred to an Apple iPhone model 7 (“iPhone 7”) (IMSI 
310410930460769). On or about September 28, 2018, Stone’s cellular telephone number was 
transferred to an Apple iPhone model XS (“iPhone XS”) (IMSI 310410155529814). 

76. Records produced by Uber Technologies, Inc. Ss 
show that the account associated with Stone’s telephone number and email address has the Uber 
application on multiple devices, including a device identified as iPhonel 1,2, UDID - 668EDC66- 
29BF-4AD2-8BCA-D974C7906597. Publicly available information indicates that the identifier 
‘“iPhonel1,2” correlates to an Apple iPhone model XS. Additionally, the subpoena returns 
identified a device identified as iPhone9,4, UDID - 7161CF59-6F10-41C8-984B- 
DE08401EDA74. Publicly available information indicates that the identifier iPhone9,4 
correlates to an Apple iPhone model iPhone 7 Plus. 

ie Records obtained from a court-authorized pen register/trap & trace (“PRTT”) 


monitoring of Stone’s personal cellular telephone number B shows recent activity 


2 When the external is plugged in, the Time Machine will automatically make hourly backups 
for the past 24 hours, daily backups for the past month, and weekly backups for all previous 
months. The oldest backups are deleted when the external storage device selected as the backup 
disk is full. The external device can be as small as a USB thumb drive. 
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indicating Stone continues to use the number and its associated device. For example, these 
records show that between January 1, 2019 and January 10, 2019, telephone number x3034 was 
used to make or receive over 150 telephone calls and send or receive over 750 text messages. 
Likewise, a court-authorized PRTT of Stone’s WhatsApp account (which is registered to Stone’s 
telephone number | showed the WhatsApp account was used to send or receive 
approximately 13 WhatsApp messages and two WhatsApp voice calls between on or about 
January 1, 2019 and January 10, 2019. 

78. Statements attributed to Stone in recent media articles also indicate that Stone 
retains computer devices that he no longer uses and keeps relevant electronic communications on 
those devices. In or around November 2018, media reports began to publish excerpts of text 
messages between Stone and Randy Credico that occurred during the 2016 U.S. election (copies 
of these text messages subsequently were obtained from Stone O 
According to these news articles, Stone released these messages to the media outlets, which 
Stone claimed were extracted by his lawyers from “a cell phone he stopped using in 2016.” 
Based on these statements, your affiant believes the cellular telephone referenced in the article to 


be the iPhone 5s documented in the aforementioned AT&T records (which records indicate he 


“| Installation and use of PRTT devices for x3034 was authorized by the U.S. District Court for 
the District of Columbia on or about November 28, 2018. Case No. 1:18-pr-172 (D.D.C. Nov. 
28, 2018). 


*2 Installation and use of PRTT devices for Stone’s WhatsApp account was authorized by the 
U.S. District Court for the District of Columbia on or about December 11, 2018. Case No. 1:18- 
pr-250 (D.D.C. Dec. 11, 2018). 


> See, e.g, “Bombshell Text Messages Support Roger Stone’s Claims About WikiLeaks 


Backchannel,” Daily Caller, Nov. 14, 2018, available at 
https://dailycaller.com/2018/11/14/roger-stone-wikileaks-randy-credico-mueller. 
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stopped using on or about November 14, 2016). Further, your affiant believes Stone maintains 
other devices he is no longer actively using. 


COMPUTERS, ELECTRONIC STORAGE, AND FORENSIC ANALYSIS 


79. As described above and in Attachment B, this application seeks permission to 
search for records that might be found in the Subject Premises, in whatever form they are found. 
One form in which the records might be found is data stored on a computer device’s hard drive 
or other storage media. Thus, the warrant applied for would authorize the seizure of electronic 
storage media or, potentially, the copying of electronically stored information, all under Rule 
41(e)(2)(B). 

80. Probable cause. I submit that if a computer or storage medium is found on the 
Subject Premises, there is probable cause to believe those records will be stored on that computer 
or storage medium, for at least the following reasons: 

a. Based on my knowledge, training, and experience, I know that computer files or 
remnants of such files can be recovered months or even years after they have been 
downloaded onto a storage medium, deleted, or viewed via the Internet. 
Electronic files downloaded to a storage medium can be stored for years at little 
or no cost. Even when files have been deleted, they can be recovered months or 
years later using forensic tools. This is so because when a person “deletes” a file 
on a computer, the data contained in the file does not actually disappear; rather, 


that data remains on the storage medium until it is overwritten by new data. 


j , Stone produced some text messages between he and 


Credico; the latest-in-time text message produced by Stone occurred on or about November 14, 
2016. The government believes copies of later-in-time text messages from late 2016 and early 
2017 could be located on another device, such as the iPhone 7 described above, or on backup 
storage media. 
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81. 


b. Therefore, deleted files, or remnants of deleted files, may reside in free space or 


slack space—that is, in space on the storage medium that is not currently being 
used by an active file—for long periods of time before they are overwritten. In 
addition, a computer’s operating system may also keep a record of deleted data in 
a “swap” or “recovery” file. 

Wholly apart from user-generated files, computer storage media—in particular, 
computers’ internal hard drives—contain electronic evidence of how a computer 
has been used, what it has been used for, and who has used it. To give a few 
examples, this forensic evidence can take the form of operating system 
configurations, artifacts from operating system or application operation, file 
system data structures, and virtual memory “swap” or paging files. Computer 
users typically do not erase or delete this evidence, because special software is 
typically required for that task. However, it is technically possible to delete this 
information. 

Similarly, files that have been viewed via the Internet are sometimes 
automatically downloaded into a temporary Internet directory or “cache.” 


Forensic evidence. As further described in Attachment B, this application seeks 


permission to locate not only computer files that might serve as direct evidence of the crimes 


described on the warrant, but also for forensic electronic evidence that establishes how 


computers were used, the purpose of their use, who used them, and when. There is probable 


cause to believe that this forensic electronic evidence will be on any storage medium in the 


Subject Premises because: 
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a. Data on the storage medium can provide evidence of a file that was once on the 
storage medium but has since been deleted or edited, or of a deleted portion of a 
file (such as a paragraph that has been deleted from a word processing file). 
Virtual memory paging systems can leave traces of information on the storage 
medium that show what tasks and processes were recently active. Web browsers, 
e-mail programs, and chat programs store configuration information on the 
storage medium that can reveal information such as online nicknames and 
passwords. Operating systems can record additional information, such as the 
attachment of peripherals, the attachment of USB flash storage devices or other 
external storage media, and the times the computer was in use. Computer file 
systems can record information about the dates files were created and the 
sequence in which they were created, although this information can later be 
falsified. 

b. As explained herein, information stored within a computer and other electronic 
storage media may provide crucial evidence of the “who, what, why, when, 
where, and how” of the criminal conduct under investigation, thus enabling the 
United States to establish and prove each element or alternatively, to exclude the 
innocent from further suspicion. In my training and experience, information 
stored within a computer or storage media (e.g., registry information, 
communications, images and movies, transactional information, records of 
session times and durations, internet history, and anti-virus, spyware, and 
malware detection programs) can indicate who has used or controlled the 


computer or storage media. This “user attribution” evidence is analogous to the 
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search for “indicia of occupancy” while executing a search warrant at a residence. 
The existence or absence of anti-virus, spyware, and malware detection programs 
may indicate whether the computer was remotely accessed, thus inculpating or 
exculpating the computer owner. Further, computer and storage media activity 
can indicate how and when the computer or storage media was accessed or used. 
For example, as described herein, computers typically contains information that 
log: computer user account session times and durations, computer activity 
associated with user accounts, electronic storage media that connected with the 
computer, and the IP addresses through which the computer accessed networks 
and the internet. Such information allows investigators to understand the 
chronological context of computer or electronic storage media access, use, and 
events relating to the crime under investigation. Additionally, some information 
stored within a computer or electronic storage media may provide crucial 
evidence relating to the physical location of other evidence and the suspect. For 
example, images stored on a computer may both show a particular location and 
have geolocation information incorporated into its file data. Such file data 
typically also contains information indicating when the file or image was created. 
The existence of such image files, along with external device connection logs, 
may also indicate the presence of additional electronic storage media (e.g., a 
digital camera or cellular phone with an incorporated camera). The geographic 
and timeline information described herein may either inculpate or exculpate the 
computer user. Last, information stored within a computer may provide relevant 


insight into the computer user’s state of mind as it relates to the offense under 
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investigation. For example, information within the computer may indicate the 
Owner’s motive and intent to commit a crime (e.g., internet searches indicating 
criminal planning), or consciousness of guilt (e.g., running a “wiping” program to 
destroy evidence on the computer or password protecting/encrypting such 
evidence in an effort to conceal it from law enforcement). 

A person with appropriate familiarity with how a computer works can, after 
examining this forensic evidence in its proper context, draw conclusions about 
how computers were used, the purpose of their use, who used them, and when. 
The process of identifying the exact files, blocks, registry entries, logs, or other 
forms of forensic evidence on a storage medium that are necessary to draw an 
accurate conclusion is a dynamic process. While it is possible to specify in 
advance the records to be sought, computer evidence is not always data that can 
be merely reviewed by a review team and passed along to investigators. Whether 
data stored on a computer is evidence may depend on other information stored on 
the computer and the application of knowledge about how a computer behaves. 
Therefore, contextual information necessary to understand other evidence also 
falls within the scope of the warrant. 

Further, in finding evidence of how a computer was used, the purpose of its use, 
who used it, and when, sometimes it is necessary to establish that a particular 
thing is not present on a storage medium. For example, the presence or absence 
of counter-forensic programs or anti-virus programs (and associated data) may be 


relevant to establishing the user’s intent. 
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82. Necessity of seizing or copying entire computers or storage media. In most cases, 
a thorough search of a premises for information that might be stored on storage media often 
requires the seizure of the physical storage media and later off-site review consistent with the 
warrant. In lieu of removing storage media from the premises, it is sometimes possible to make 
an image copy of storage media. Generally speaking, imaging is the taking of a complete 
electronic picture of the computer’s data, including all hidden sectors and deleted files. Either 
seizure or imaging is often necessary to ensure the accuracy and completeness of data recorded 
on the storage media, and to prevent the loss of the data either from accidental or intentional 
destruction. This is true because of the following: 

a. The time required for an examination. As noted above, not all evidence takes the 
form of documents and files that can be easily viewed on site. Analyzing 
evidence of how a computer has been used, what it has been used for, and who 
has used it requires considerable time, and taking that much time on premises 
could be unreasonable. As explained above, because the warrant calls for forensic 
electronic evidence, it is exceedingly likely that it will be necessary to thoroughly 
examine storage media to obtain evidence. Storage media can store a large 
volume of information. Reviewing that information for things described in the 
warrant can take weeks or months, depending on the volume of data stored, and 
would be impractical and invasive to attempt on-site. 

b. Technical requirements. Computers can be configured in several different ways, 
featuring a variety of different operating systems, application software, and 
configurations. Therefore, searching them sometimes requires tools or knowledge 


that might not be present on the search site. The vast array of computer hardware 
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and software available makes it difficult to know before a search what tools or 
knowledge will be required to analyze the system and its data on the Premises. 
However, taking the storage media off-site and reviewing it in a controlled 
environment will allow its examination with the proper tools and knowledge. 

c. Variety of forms of electronic media. Records sought under this warrant could be 
stored in a variety of storage media formats that may require off-site reviewing 
with specialized forensic tools. 

83. Nature of examination. Based on the foregoing, and consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit seizing, imaging, or otherwise copying 
storage media that reasonably appear to contain some or all of the evidence described in the 
warrant, and would authorize a later review of the media or information consistent with the 
warrant. The later review may require techniques, including but not limited to computer-assisted 
scans of the entire medium, that might expose many parts of a hard drive to human inspection in 
order to determine whether it is evidence described by the warrant. 

84. Because multiple people share the Subject Premises as a residence, it is possible 
that the Subject Premises will contain storage media that are predominantly used, and perhaps 
owned, by persons who are not suspected of a crime. If it is nonetheless determined that that it is 
possible that the things described in this warrant could be found on any of those computers or 
storage media, the warrant applied for would permit the seizure and review of those items as 


well. 
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FILTER REVIEW PROCEDURES 

85. Review of the items described in Attachment B will be conducted pursuant to 
established procedures designed to collect evidence in a manner consistent with professional 
responsibility requirements concerning the maintenance of attorney-client and other operative 
privileges. The procedures include use of a designated “filter team,” separate and apart from the 
investigative team, in order to address potential privileges. 

CONCLUSION 

86. Based on the foregoing, your affiant respectfully requests that this Court issue a 
search warrant for the Subject Premises, more particularly described in Attachment A, 
authorizing the seizure of the items described in Attachment B. 


Respectfully submitted, 


ts A. Heide 
Special Agent 
Federal Bureau of Investigation 


Sworn and subscribed before me on this [_ day of January, 2019. 


C hasa S. SNOW 


UNITED STATES MAGISTRATE JUDGE 
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